Critical Auth Bypass in Integrics Enswitch Allows Password Takeover

Integrics Enswitch versions 3.13 through 4.4 contain a critical authentication bypass vulnerability that allows unauthenticated attackers to change account passwords. The flaw, tracked as CVE-2026-107640, enables threat actors to take over administrative accounts without valid credentials.

The vulnerability stems from a logic error in the password update API endpoint located at /api/json/user/password/update/. According to the National Vulnerability Database (NVD), the issue is classified under CWE-640 (Improper Verification of Cryptographic Signature) and carries a CVSS score of 9.3, placing it in the Critical severity range. The core of the exploit involves an attacker omitting the reset parameter during a password change request.

Exploitation Mechanics

The attack vector targets accounts that do not have a pending password reset request. When an attacker attempts to update a password for such an account, the system checks for a reset key. If the reset parameter is omitted, the system defaults to an empty value. For accounts with no pending reset, the stored reset_key is also empty. This mismatch allows the empty default value to match the empty stored key, effectively bypassing the authentication requirement.

To successfully exploit this vulnerability, an attacker must first enumerate valid usernames within the target environment. Once a valid username is identified, the attacker can submit a password change request to the vulnerable endpoint without providing the necessary reset token. Because the system accepts the empty default as a valid match for the empty stored key, the password is updated, granting the attacker full control of the account. This method is particularly dangerous because it can be used to compromise administrator accounts, which typically have elevated privileges and broader access to the system.

Who Is Affected

The vulnerability affects all installations of Integrics Enswitch from version 3.13 up to and including version 4.4. Organizations running these versions are exposed to the risk of unauthorized account takeover. The impact is significant because the attack does not require any prior authentication, making it accessible to external attackers who can reach the API endpoint. The ability to change passwords for any user, including administrators, means that an attacker can potentially gain complete control over the Enswitch instance and any connected systems or data.

What should you do?

No official patch or update has been confirmed yet for CVE-2026-107640. Administrators running affected versions of Integrics Enswitch should monitor vendor communications for a security release. In the interim, organizations may consider restricting external access to the /api/json/user/password/update/ endpoint through firewall rules or web application firewalls to mitigate the risk of unauthenticated exploitation. Ensuring that the API is not publicly accessible can reduce the attack surface while a permanent fix is developed.