Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response retu...
CVE-2026-28213
Summary
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1....
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| evershop | evershop | <= 2.1.1 | – |
Original title
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response retu...
Original description
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
nvd CVSS3.1
9.8
Vulnerability type
CWE-200
Information Exposure
CWE-640
- https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1 Product Release Notes
- https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-... Vendor Advisory
Published: 26 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026