Three critical vulnerabilities disclosed this week share a common weakness: password reset logic that fails to validate tokens properly. CVE-2026-18550 in the Nokri Job Board WordPress theme allows unauthenticated attackers to hijack admin accounts through an empty token bypass. CVE-2026-84699 in Team Password Manager permits unauthorised password resets without authentication, exposing concentrated credential stores. CVE-2026-84480 in WWBN AVideo allows permanently valid reset tokens with no expiry. Meanwhile, Shadowserver Foundation confirms 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. This episode examines why account recovery flows represent a systemic weak point in authentication systems, how attackers exploit reset endpoints that lack proper validation, and what UK small businesses should verify with IT providers about password reset security across their entire technology estate.
