What is the CVSS score of CVE-2026-45055?

CVE-2026-45055 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of CubeCart are affected by CVE-2026-45055?

CubeCart 6.6.x through 6.7.1 contains a critical account takeover vulnerability allowing unauthenticated attackers to hijack customer credentials via host header poisoning in the password reset flow.. A patch is available.

How to fix or mitigate CVE-2026-45055?

Within 24 hours: Inventory all CubeCart installations and identify those running versions 6.6.x through 6.7.1. Within 7 days: Deploy vendor-provided security patch to all affected systems and review password reset logs for unauthorized activity. Within 30 days: Verify patch deployment completeness and consider issuing password reset notification to all users.

CubeCart CVE-2026-45055

EUVD-2026-30172 HIGH

Improper Input Validation (CWE-20)

2026-05-13 GitHub_M

PHP Information Disclosure Cubecart V6

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:52 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x - 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in User::passwordRequest() (and the admin equivalent in Admin::passwordRequest()). An unauthenticated attacker who knows a target email can POST /index.php?_a=recover with Host: evil.com; CubeCart writes a fresh verify token (valid 3,600 s) and emails the victim a link http://evil.com/index.php?_a=recovery&validate=<TOKEN>. The token is valid against the legitimate store - capturing the victim's click on evil.com yields full account takeover, or store takeover when an admin email is targeted. This vulnerability is fixed in 6.7.2.

AnalysisAI

Account and store takeover in CubeCart 6.6.x through 6.7.1 is possible because the CC_STORE_URL constant is derived from the unvalidated Host header at bootstrap and embedded into password-reset emails. A remote unauthenticated attacker who knows a victim's email address can trigger a host-header poisoning attack that emails the user a reset link pointing at attacker-controlled infrastructure, capturing a valid 3,600-second token on click. SSVC reports a public POC and total technical impact, while EPSS remains low (0.03%) and no public exploit is identified as in-the-wild.

Technical ContextAI

CubeCart is a PHP-based ecommerce platform (CPE cpe:2.3:a:cubecart:v6). The flaw is a textbook CWE-20 (Improper Input Validation) host-header injection: at application bootstrap, the framework constructs CC_STORE_URL directly from the incoming HTTP Host request header without an allowlist of trusted hostnames. That constant is then concatenated verbatim into transactional emails, including the password-reset link produced by User::passwordRequest() and the administrative counterpart Admin::passwordRequest(). Because the underlying verify token is generated and stored against the legitimate database, the token remains valid on the real store regardless of the hostname embedded in the outgoing link, which converts a routing-layer trust assumption into an authentication bypass primitive.

RemediationAI

Vendor-released patch: upgrade to CubeCart 6.7.2 or later, as documented in GHSA-7pvc-gxc4-chmc (https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc). Where immediate upgrade is not feasible, enforce a strict Host/X-Forwarded-Host allowlist at the upstream reverse proxy or WAF so only the canonical store hostname reaches PHP - be aware this can break legitimate multi-domain storefronts and staging environments. As an additional compensating control, hard-code the canonical base URL in CubeCart configuration and override any code path that reads it from the request, and consider shortening or invalidating in-flight password-reset tokens (default 3,600 seconds) to narrow the click window; the side effect is users with delayed mail delivery may need to re-request resets.