CVE-2022-40084: Opencrx

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.

Affected products

• Opencrx Opencrx: up to and including 5.2.2

Published 2022-10-20. Last modified 2026-06-17.