What is the CVSS score of CVE-2022-50910?

CVE-2022-50910 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Beehive Forum are affected by CVE-2022-50910?

Organizations using Beehive Forum 1.5.2 face critical risk from CVE-2022-50910, a weak password recovery vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2022-50910?

Yes, a public proof-of-concept exploit is available for CVE-2022-50910. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2022-50910?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Beehive Forum CVE-2022-50910

CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-01-13 disclosure@vulncheck.com

Code Injection Beehive Forum

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 16:16 vuln.today

Public exploit code

CVE Published

Jan 13, 2026 - 23:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can inject a malicious host header to intercept password reset tokens and change victim account passwords without direct authentication.

AnalysisAI

Beehive Forum 1.5.2 has host header injection in the forgot password function that allows intercepting password reset tokens. PoC available.

Technical ContextAI

The forgot password function uses the Host header to construct reset URLs (CWE-640). An attacker injects their domain as the host, causing the reset email to contain a link pointing to the attacker's server.

RemediationAI

Use a configured base URL instead of the Host header for email links.

CVE-2022-50910 vulnerability details – vuln.today

Back

Beehive Forum CVE-2022-50910

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code