CVE-2026-40905
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-601
Redireccionamiento de URL a sitio no confiable (Open Redirect)
Fecha de publicación:
21/04/2026
Última modificación:
21/04/2026
Descripción
*** Pendiente de traducción *** LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email containing a malicious link pointing to an attacker-controlled domain. When the victim clicks the link, the password reset token is transmitted to the attacker-controlled server. An attacker can capture this token and use it to reset the victim’s password, leading to full account takeover. This vulnerability is fixed in 2.5.4.
Impacto
Puntuación base 3.x
8.10
Gravedad 3.x
ALTA