CVE-2026-14850: Arbitrary Password Reset in MobiAPParc
A client-controlled user_id in MobiAPParc’s password recovery flow allowed arbitrary password resets. Predictable IDs, email enumeration, and missing rate limiting increased the impact.
Security Research