Integrics - Enswitch - CRITICAL - CVE-2026-107640. Integrics Enswitch versions 3.13 through 4.4 are affected by an authentication bypass vulnerability that enables unauthenticated attackers to change account passwords. This issue arises from a flaw in the /api/json/user/password/update/ endpoint, allowing attackers to circumvent authentication by omitting the reset parameter. Attackers can exploit this vulnerability to target accounts without pending resets, taking advantage of the default empty reset_key. By enumerating valid usernames, they can potentially gain control over administrator accounts. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io