---
id: CVE-2026-108048
title: >-
  Vulnerability due to a lack of request limits in Alosuite’s password recovery
  functionality.
summary: >-
  Vulnerability due to a lack of request limits in Alosuite’s password recovery
  functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate
  restrictions on the number or frequency of password reset requests sent for a
  single …
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-770
vendor: AM System
product: ALO Suite
affected:
  - alo_suite 25_09_15.03_35
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T13:36:14.547723Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:36:26.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108048'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite
tags:
  - cve.org
epss: 0.00401
epssPercentile: 0.34559
ingestedAt: '2026-11-05T19:30:42.951Z'
---

## Overview

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

## Affected

- `alo_suite 25_09_15.03_35`

## Remediation

The manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version.