CVE-2026-28213Disclosure(evershop / evershop)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch evershop evershop systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

evershop CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw

Other references

https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1

Weakness type (CWE)

CWE-200CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

evershop

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-02-26); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

evershop

Products

evershop

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

233.3%

Patch

233.3%

General

233.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-26	2	Disclosure1Patch1
2026-02-27	2	General2
2026-02-28	1	Patch1
2026-03-03	1	Disclosure1

Full discourse6 posts

CVEFind.com@CveFindCom224d
Patch
[CVE-2026-28213: CRITICAL] Cybersecurity alert: EverShop eCommerce platform has a critical vulnerability in "Forgot Password" feature pre-version 2.1.1, enabling account takeover. Update to secure your onlin...#cve,CVE-2026-28213,#cybersecurity https://cvefind.com/CVE-2026-28213
Post summary
The tweet announces a critical CVE (CVE‑2026‑28213) that enables account takeover via EverShop’s Forgot Password feature and urges users to update to the patched version 2.1.1.
0001075
585 followersView on X
CRAC Learning - Tech@cracbot220d
Disclosure
CVE-2026-28213 (CVSS:9.8, CRITICAL) is Analyzed. EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password"..https://nvd.nist.gov/vuln/detail/CVE-2026-28213 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-28213, a critical vulnerability in EverShop’s Forgot Password feature affecting versions before 2.1.1, with a CVSS score of 9.8.
0000034
173 followersView on X
PulsePatch.io@pulsepatchio223d
Patch
`EverShop` is vulnerable to arbitrary customer account takeover (CVE-2026-28213) due to exposed password reset tokens in API responses. Patch to `cb37edc0cdddbd45761749bbe544119331bdbf35` to mitigate this #eCommerce #infosec vulnerability. https://www.pulsepatch.io/posts/cve-2026-28213-evershop-account-takeover
Post summary
EverShop suffers an account‑takeover flaw from exposed reset tokens, and a specific patch commit along with a remedy link are provided.
0000047
1 followersView on X
CVE@CVEnew223d
General
CVE-2026-28213 EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email… https://www.cve.org/CVERecord?id=CVE-2026-28213
Post summary
The post notes a CVE affecting EverShop's Forgot Password feature but offers no further technical or operational detail.
00000143
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds224d
General
CVE-2026-28213 EverShop Authentication Bypass Vulnerability in Password Reset Functionality https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28213
Post summary
The text lists CVE‑2026‑28213 and notes it is an authentication bypass in EverShop’s password reset feature, linking to a details page but providing no further technical or operational context.
0000036
4.0K followersView on X
CVETodo@CveTodo224d
Disclosure
# CVE-2026-28213 Security Assessment ## 1. Overview of the Vulnerability CVE-2026-28213 pertains to a critical security flaw in EverShop, an eCommerce platform built with TypeScript. The vulnerability exists in the "Forgot Password" functionality of versions prior to 2.1.1. Specifically, when a user requests a password reset by providing an email address, the API response inadvertently includes the password reset token. This token is intended to be a secret string used to verify the user's iden #Cybersecurity #CVE #CriticalCVE #CriticalVulnerability #RemoteCodeExecution https://cvetodo.com/cve/CVE-2026-28213
Post summary
The tweet discloses a critical flaw in EverShop’s forgot‑password flow that leaks reset tokens via API responses.
0000037
20 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	evershop	evershop	-	node.js	-

Explore more

Back to dashboard evershop CVEs evershop vulnerabilities

What researchers are saying

CVE-2026-28213

CVETodo[verified]@CveTodoDisclosure

The tweet discloses a critical flaw in EverShop’s forgot‑password flow that leaks reset tokens via API responses.

CVEFind.com@CveFindComPatch

The tweet announces a critical CVE (CVE‑2026‑28213) that enables account takeover via EverShop’s Forgot Password feature and urges users to update to the patched version 2.1.1.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-28213, a critical vulnerability in EverShop’s Forgot Password feature affecting versions before 2.1.1, with a CVSS score of 9.8.

PulsePatch.io@pulsepatchioPatch

EverShop suffers an account‑takeover flaw from exposed reset tokens, and a specific patch commit along with a remedy link are provided.

CVE@CVEnewGeneral

The post notes a CVE affecting EverShop's Forgot Password feature but offers no further technical or operational detail.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text lists CVE‑2026‑28213 and notes it is an authentication bypass in EverShop’s password reset feature, linking to a details page but providing no further technical or operational context.