CVE-2026-40905

Katalog CVE

CVSS 8.1 · High EPSS 0,40%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect'). Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email containing a malicious link pointing to an attacker-controlled domain. When the victim clicks the link, the password reset token is transmitted to the attacker-controlled server. An attacker can capture this token and use it to reset the victim’s password, leading to full account takeover. This vulnerability is fixed in 2.5.4.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Kovah/LinkAce/security/advisories/GHSA-48wv-jpf4-vjfv