CVE-2022-26313: Mendix Forgot Password

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.

Affected products

• Mendix Forgot Password: from 3.3.0, before 3.5.1 (fixed in 3.5.1)

Published 2022-03-08. Last modified 2026-06-17.