Password Manager EUVD-2026-37678

Active user interaction is required - specifically, a user must follow or interact with a link or response generated by the application that embeds the attacker-supplied Host header value (UI:A per CVSS 4.0). No authentication is required on the attacker's part (PR:N), and no special server-side configuration is needed (AT:N, AC:L). Exploitation is limited by the need for the application to generate and deliver a Host-header-reflective link to a user (e.g., via password-reset email flow or redirect), and by the user actively engaging with that content. Exploitation does not result in direct code execution or complete credential theft absent further social engineering. The vulnerability is network-reachable and requires no elevated access, but the mandatory user interaction step prevents fully automated or unauthenticated mass exploitation.

The CVSS 4.0 score of 5.1 (Medium) is consistent with the actual attack surface: no authentication or special configuration is required (PR:N, AC:L, AT:N), but active user interaction is mandatory (UI:A), which materially reduces the exploitability in automated attack scenarios. The impact is limited to partial confidentiality and integrity degradation on both the vulnerable system and dependent services (VC:L/VI:L/SC:L/SI:L), with no availability impact. The password manager context elevates real-world concern beyond the raw score - a successful Host Header Injection in a credential management application can redirect password-reset emails or links to attacker infrastructure, creating a high-impact phishing vector despite a moderate CVSS score. No EPSS data is available in the input, no KEV listing exists, and no public exploit code has been identified, all suggesting exploitation has not yet been observed at scale. The absence of specific affected version ranges (CPE uses a wildcard) means defenders cannot easily scope exposure without consulting the vendor advisory directly.

An attacker sends an HTTP request to the Password Manager application with a forged Host header value pointing to an attacker-controlled domain (e.g., Host: attacker.example.com). The application reflects this value when generating a password-reset or account-verification link, which is then delivered to the victim user via email. When the user clicks the link, their credentials or reset token are transmitted to the attacker's server rather than the legitimate application.