EUVD-2026-24473Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Remote unauthenticated attacker (AV:N/PR:N) but requires victim to click the poisoned reset link (UI:R); token theft yields account takeover (C:H/I:H), no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email containing a malicious link pointing to an attacker-controlled domain. When the victim clicks the link, the password reset token is transmitted to the attacker-controlled server. An attacker can capture this token and use it to reset the victim’s password, leading to full account takeover. This vulnerability is fixed in 2.5.4.
AnalysisAI
Password reset poisoning in LinkAce (self-hosted link archive by Kovah) before 2.5.4 allows a remote attacker to hijack accounts by injecting a malicious host into reset URLs. Because the app trusts the X-Forwarded-Host header when building password reset links, an attacker who triggers a reset for a victim can cause the emailed link to point to an attacker-controlled domain; if the victim clicks it, the valid reset token leaks to the attacker, enabling full account takeover. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with SSVC exploitation status of 'none'.
Technical ContextAI
LinkAce is a PHP/Laravel-based self-hosted web application (CPE cpe:2.3:a:kovah:linkace) for archiving and organizing website links. The flaw is a CWE-601 (open redirect / URL redirection to untrusted site) manifestation applied to password reset flows, commonly called host header / password reset poisoning. Frameworks that build absolute URLs from request-derived host values are vulnerable when they honor proxy headers like X-Forwarded-Host without validating them against an allow-list or a configured canonical application URL (e.g., Laravel's APP_URL / trusted proxies). The mailer here embeds the attacker-supplied host into the signed reset link, so while the token itself remains valid and server-generated, the delivery destination is attacker-controlled.
RemediationAI
Vendor-released patch: upgrade to LinkAce 2.5.4 or later, which fixes the header-trust flaw (see GHSA-48wv-jpf4-vjfv at https://github.com/Kovah/LinkAce/security/advisories/GHSA-48wv-jpf4-vjfv). If you cannot immediately upgrade, place LinkAce behind a reverse proxy configured to strip or overwrite incoming X-Forwarded-Host headers and to force the correct Host, and pin the application's canonical URL (e.g., set APP_URL and restrict trusted proxies) so reset links are always generated from the configured domain rather than request headers; the trade-off is that misconfigured proxy/trusted-proxy settings can break legitimate multi-host or CDN setups, so validate that normal login/reset emails still resolve to the right domain after the change. As a further containment measure, monitor for password-reset requests with anomalous Host/X-Forwarded-Host values.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today