CVE-2026-22603

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user’s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

• CWE-307

• https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7fPatch
• https://github.com/opf/openproject/pull/21272Issue Tracking
• https://github.com/opf/openproject/releases/tag/v16.6.2Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239Patch, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22598ManageIQ is an open-source management platform. A flaw was f…7.1
• CVE-2026-22599Strapi is an open source headless content management system.…7.2
• CVE-2026-2260A vulnerability was found in D-Link DCS-931L up to 1.13.0. T…7.3
• CVE-2026-22600OpenProject is an open-source, web-based project management …9.1
• CVE-2026-22601OpenProject is an open-source, web-based project management …7.2
• CVE-2026-22602OpenProject is an open-source, web-based project management …3.5
• CVE-2026-22604OpenProject is an open-source, web-based project management …5.3
• CVE-2026-22605OpenProject is an open-source, web-based project management …4.3
• CVE-2026-22606Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2026-22607Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2026-22608Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2026-22609Fickling is a Python pickling decompiler and static analyzer…7.8