CVE-2023-43650

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the password reset. Although the code is only available in 1 minute, this window potentially allows for up to 1,000,000 validation attempts. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-640
• CWE-640

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-mwx4-8fwc-2xvwExploit, Vendor Advisory
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2Exploit, Third Party Advisory
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-mwx4-8fwc-2xvwExploit, Vendor Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43645OpenFGA is an authorization/permission engine built for deve…5.9
• CVE-2023-43646get-func-name is a module to retrieve a function's name secu…7.5
• CVE-2023-43647baserCMS is a website development framework. Prior to versio…5.4
• CVE-2023-43648baserCMS is a website development framework. Prior to versio…6.5
• CVE-2023-43649baserCMS is a website development framework. Prior to versio…9.8
• CVE-2023-4365Inappropriate implementation in Fullscreen in Google Chrome …4.3
• CVE-2023-43651JumpServer is an open source bastion host. An authenticated …9.9
• CVE-2023-43652JumpServer is an open source bastion host. As an unauthentic…9.1
• CVE-2023-43654TorchServe is a tool for serving and scaling PyTorch models …9.8
• CVE-2023-43655Composer is a dependency manager for PHP. Users publishing a…8.8
• CVE-2023-43656matrix-hookshot is a Matrix bot for connecting to external s…9
• CVE-2023-43657discourse-encrypt is a plugin that provides a secure communi…6.1