CVE-2025-22144

When a user account is approved via email, the reset_code field in the database is set to NULL. However, when an account is manually approved by a user with admincp.core.emails or admincp.users.edit permissions, the reset_code field is not NULL, but rather empty (an empty string). An attacker can send an HTTP request to the forgot_password endpoint with an empty c parameter (e.g., index.php?route=/forgot_password/&c=), which the system incorrectly interprets as a valid password reset code. As a result, the attacker gains the ability to set a new password for the victim's account without any additional verification.

An attacker can take control of any user account manually approved by an administrator by changing its password without the account owner's knowledge.

Update NamelessMC to version 2.1.3 or later. The vendor reports that no known workarounds for this vulnerability exist — updating is the only recommended solution.

NamelessMC (Nameless) — versions prior to 2.1.3