CVE-2023-43623: Mendix Forgot Password

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.

Affected products

• Mendix Forgot Password: before 3.7.3 (fixed in 3.7.3); from 4.0.0, before 4.1.3 (fixed in 4.1.3); from 5.0.0, before 5.4.0 (fixed in 5.4.0)

Published 2023-10-10. Last modified 2026-06-17.