What is the CVSS score of CVE-2026-35507?

CVE-2026-35507 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35507?

Yes, a patch is available for CVE-2026-35507. Update the affected software to the latest version immediately.

Shynet CVE-2026-35507

EUVD-2026-18566 MEDIUM

Use of Less Trusted Source (CWE-348)

2026-04-03 mitre

GHSA-hvm7-86pv-v2p2

Code Injection

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.14.0

EUVD ID Assigned

Apr 03, 2026 - 01:45 euvd

EUVD-2026-18566

Analysis Generated

Apr 03, 2026 - 01:45 vuln.today

CVE Published

Apr 03, 2026 - 01:00 nvd

MEDIUM 6.4

DescriptionNVD

Shynet before 0.14.0 allows Host header injection in the password reset flow.

AnalysisAI

Host header injection in Shynet before 0.14.0 allows unauthenticated remote attackers to manipulate password reset functionality through crafted HTTP Host headers, enabling account hijacking and unauthorized access via email-based password reset flows. The vulnerability requires user interaction (clicking a reset link) and carries a CVSS score of 6.4 with confirmed patch availability in version 0.14.0.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-35507 vulnerability details – vuln.today

Back