Redwood is vulnerable to account takeover via dbAuth "forgot-password

Description

This is an API vulnerability in Redwood’s [dbAuth], specifically the dbAuth forgot password feature:

• only projects with the dbAuth “forgot password” feature are affected
• this vulnerability was introduced in v0.38.0

Recommendation

Update the @redwoodjs/api package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.3.1

  >= 0.38.0, < 2.2.5**

• Patched version(s): **3.3.1

  2.2.5**

References

• GHSA-3qmc-2r76-4rqp

Related Issues

• StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation - CVE-2026-32103
• a12nserver vulnerable to potential SQL Injections via Knex dependency - Vulnerability
• Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter - CVE-2026-27804
• Parse Server OAuth2 authentication adapter account takeover via identity spoofing - CVE-2026-30967

Tags:

npm

@redwoodjs/api