What is the CVSS score of CVE-2025-69240?

CVE-2025-69240 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Raytha are affected by CVE-2025-69240?

Raytha CMS versions prior to 1.4.6 contain a host header injection vulnerability that enables attackers to intercept password reset tokens and hijack user accounts using only a victim's email…. A patch is available.

How to fix or mitigate CVE-2025-69240?

Within 24 hours: Identify all Raytha CMS instances and document current versions. Within 7 days: Upgrade all Raytha CMS deployments to version 1.4.6 or later; verify upgrades in staging environment first. Within 30 days: Conduct password reset audit for accounts accessed during vulnerability exposure window and implement header validation monitoring.

Raytha CVE-2025-69240

EUVD-2025-208707 HIGH

Use of Less Trusted Source (CWE-348)

2026-03-16 CERT-PL

Authentication Bypass Information Disclosure Raytha

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4.6

EUVD ID Assigned

Mar 16, 2026 - 12:00 euvd

EUVD-2025-208707

Analysis Generated

Mar 16, 2026 - 12:00 vuln.today

CVE Published

Mar 16, 2026 - 11:53 nvd

HIGH 7.5

DescriptionCVE.org

Raytha CMS allows an attacker to spoof X-Forwarded-Host or Host headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account.

This issue was fixed in version 1.4.6.

AnalysisAI

A host header injection vulnerability in Raytha CMS allows attackers to hijack password reset tokens by spoofing X-Forwarded-Host or Host headers, leading to account takeover. The vulnerability affects all versions prior to 1.4.6 and requires only that the attacker knows the victim's email address to initiate the attack chain. With a CVSS 7.5 score and requiring user interaction, this represents a significant authentication bypass risk for organizations using the affected CMS versions.

Technical ContextAI

Raytha CMS is a content management system that improperly validates host headers when generating password reset links, falling under CWE-348 (Use of Less Trusted Source). The application trusts user-controlled headers (X-Forwarded-Host or Host) when constructing URLs for password reset emails, allowing an attacker to inject their own domain. This is a common vulnerability pattern in web applications that generate absolute URLs based on incoming HTTP headers without proper validation, particularly problematic in multi-tenant or reverse proxy environments where these headers are commonly used.

RemediationAI

Upgrade Raytha CMS to version 1.4.6 or later immediately to address this vulnerability. Until patching is possible, consider implementing additional email validation for password reset requests, such as requiring users to confirm reset requests through a separate channel or implementing rate limiting on password reset functionality. Organizations should also monitor for unusual password reset activity and educate users about the risks of clicking unexpected password reset links.