CVE-2023-27464: Mendix Forgot Password

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information.

Affected products

• Mendix Forgot Password: before 3.7.1 (fixed in 3.7.1); from 4.0.0, before 4.1.1 (fixed in 4.1.1); from 5.0.0, before 5.1.1 (fixed in 5.1.1)

Published 2023-04-11. Last modified 2026-06-17.