Weak Password Recovery Mechanism in Tourism Management System

CVE-2026-90522 affects the password recovery functionality in jaychouchannel's Tourism-Management-System, specifically within the resetPass function of UsersController.java. With a CVSS score of 7.3, this vulnerability enables attackers to bypass or weaken password recovery mechanisms remotely, potentially allowing unauthorized account takeover. Organizations deploying this tourism management platform—including travel agencies, hotel chains, and booking platforms—face direct risk of credential compromise. The publicly disclosed exploit status elevates urgency, as threat actors can immediately leverage this weakness to gain unauthorized access to sensitive customer and business data.

While MITRE ATT&CK mapping is not yet assigned to this CVE, the underlying weakness (CWE-640: Weak Password Recovery Mechanism) aligns with credential access tactics. Casky's 754 mapped security skills, powered by Claude AI's extended reasoning capabilities, would detect attack patterns associated with account compromise by analyzing authentication anomalies, unusual password reset requests, and account access from suspicious locations. Practitioners using Casky would observe findings related to: abnormal login patterns following failed authentication attempts, multiple concurrent password reset requests, and access to the password recovery endpoint from unexpected network origins. These behavioral indicators, correlated across your security telemetry, reveal exploitation attempts targeting this weakness before successful account takeover occurs.