rdiffweb prior to 2.5.0a4 allows users to set their new password to be the same as the old password during a password reset. Version 2.5.0a4 enforces a password policy in which a new password cannot be the same as the old one.
{ "nvd_published_at": "2022-10-06T18:16:00Z", "cwe_ids": [ "CWE-521" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-10-06T20:10:38Z" }