https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:22:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326980 EUVD-2026-326980 https://cve.radiocsirt.org/vuln/euvd-2026-326980 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45013 <p>ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim&#39;s email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker&#39;s domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.</p> <p>ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim&#39;s email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker&#39;s domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45013 https://cve.radiocsirt.org/vuln/ghsa-gf43-24g3-5hw2 <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>ApostropheCMS&#39;s password reset flow constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim&#39;s email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker&#39;s domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover.</p> <p>## Affected Component</p> <p>`modules/@apostrophecms/login/index.js` — `resetRequest` route Precondition: `passwordReset: true` is set **and** `apos.baseUrl` is not configured.</p> <p>## Vulnerability Details</p> <p>The `setPrefixUrls` middleware (i18n layer) builds `req.baseUrl` using `req.hostname`:</p> <p>```js // Simplified from i18n middleware req.baseUrl = `${req.protocol}://${req.hostname}`; req.absoluteUrl = req.baseUrl + req.url; ```</p> <p>The `resetRequest` handler then passes this tainted value directly into URL construction:</p> <p>```js const parsed = new URL( req.absoluteUrl, // ← tainted by attacker&#39;s Host header self.apos.baseUrl ? undefined : `${req.protocol}://${req.hostname}${port}` // ← also tainted ); parsed.pathname = &#39;/login&#39;; parsed.searchParams.append(&#39;reset&#39;, reset); // real, valid token parsed.searchParams.append(&#39;email&#39;, user.email); await self.email(..., { url: parsed.toString() }, ...); // Email sent to victim with URL pointing…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>ApostropheCMS&#39;s password reset flow constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim&#39;s email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker&#39;s domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover.</p> <p>## Affected Component</p> <p>`modules/@apostrophecms/login/index.js` — `resetRequest` route Precondition: `passwordReset: true` is set **and** `apos.baseUrl` is not configured.</p> <p>## Vulnerability Details</p> <p>The `setPrefixUrls` middleware (i18n layer) builds `req.baseUrl` using `req.hostname`:</p> <p>```js // Simplified from i18n middleware req.baseUrl = `${req.protocol}://${req.hostname}`; req.absoluteUrl = req.baseUrl + req.url; ```</p> <p>The `resetRequest` handler then passes this tainted value directly into URL construction:</p> <p>```js const parsed = new URL( req.absoluteUrl, // ← tainted by attacker&#39;s Host header self.apos.baseUrl ? undefined : `${req.protocol}://${req.hostname}${port}` // ← also tainted ); parsed.pathname = &#39;/login&#39;; parsed.searchParams.append(&#39;reset&#39;, reset); // real, valid token parsed.searchParams.append(&#39;email&#39;, user.email); await self.email(..., { url: parsed.toString() }, ...); // Email sent to victim with URL pointing…</p> https://cve.radiocsirt.org/vuln/ghsa-gf43-24g3-5hw2