vtenext Authentication Bypass Lets Attackers Change Any Account Password

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification.

An attacker who knows a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and take over accounts.

• Affected: vtenext 25.02 before 25.02.1
• Precondition: attacker knows a valid user_name
• Impact: attacker can change any account password and log in as administrators lacking two-factor authentication