MacCMS Authentication Bypass Allows Account Takeover

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password.

The bug is in check_msg(), which never compares msg_to. An attacker can request a password recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset using the victim's email or phone, taking over the account.