CVE-2026-93556: Authorization Bypass Through User-Controlled Key

The password-recovery endpoint does not validate the recovery-process JWT against the user specified by the “usuariId” parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, potentially allowing account takeover.