What is the CVSS score of CVE-2025-52560?

CVE-2025-52560 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Kanboard are affected by CVE-2025-52560?

Kanboard versions prior to 1.2.46 contain a critical flaw that allows attackers to hijack user accounts-including administrator accounts-by crafting malicious password reset links.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52560?

Yes, a public proof-of-concept exploit is available for CVE-2025-52560. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-52560?

Within 24 hours: Inventory all Kanboard instances and their versions; notify users not to use password reset functionality until patched. Within 7 days: Upgrade all affected Kanboard instances to version 1.2.46 or later; validate the application_url configuration is explicitly set post-upgrade. Within 30 days: Conduct access review of all user accounts for unauthorized changes; enforce password rotation for users who initiated resets during the vulnerable period; implement monitoring for suspicious account access patterns.

Kanboard CVE-2025-52560

EUVD-2025-18976 HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2025-06-24 security-advisories@github.com

Information Disclosure Kanboard

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18976

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

Patch released

Mar 15, 2026 - 22:36 nvd

Patch available

PoC Detected

Jan 13, 2026 - 19:35 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 03:15 nvd

HIGH 8.1

DescriptionGitHub Advisory

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.

AnalysisAI

Kanboard prior to version 1.2.46 contains a host header injection vulnerability that allows unauthenticated attackers to craft malicious password reset emails with attacker-controlled URLs when the application_url configuration is unset (default state). If a victim clicks the poisoned reset link, their password reset token is leaked to the attacker's domain, enabling complete account takeover including administrative accounts. This vulnerability requires user interaction (clicking a link) but affects all users initiating password resets on vulnerable instances, making it a practical and high-impact attack vector for account compromise.

Technical ContextAI

The vulnerability stems from improper input validation of the HTTP Host header (CWE-640: Weak Password Recovery Mechanism for Forgotten Password). Kanboard's password reset functionality dynamically constructs password reset URLs using the Host header when the application_url configuration parameter is not explicitly set. This is a classic host header injection flaw where attacker-controlled input from HTTP headers is trusted without validation. The root cause is in the email generation code that builds the reset link URL—it should either: (1) validate the Host header against a whitelist, (2) require explicit application_url configuration without fallback to unvalidated headers, or (3) use a safe canonical domain for reset links. The affected product is Kanboard project management software (CPE: purl:pkg:npm/kanboard or equivalent), specifically versions prior to 1.2.46. The vulnerability is present in the password reset email generation component.

RemediationAI

Immediate actions: (1) Upgrade Kanboard to version 1.2.46 or later - this is the definitive fix that validates Host headers and no longer relies on unvalidated headers for password reset URLs. (2) For instances that cannot immediately upgrade, set the 'application_url' configuration parameter explicitly in config.php to your actual canonical domain (e.g., 'application_url' => 'https://kanboard.company.com'). This bypasses the vulnerable Host header fallback logic. (3) Monitor password reset activity and user login logs for suspicious patterns (logins from unusual locations or times following reset emails). (4) Consider temporarily disabling password reset functionality if the application is internet-facing and patching cannot be applied immediately. (5) Review and audit any password resets initiated while the instance was vulnerable. (6) Force password reset for all users (especially administrators) post-patching to invalidate any tokens that may have been compromised. Deployment verification: After patching to 1.2.46, verify that password reset emails contain URLs using the configured application_url or a properly validated Host header, not attacker-controlled domains.