EUVD-2026-83249Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H because exploitation requires a chained wildcard-ALLOWED_HOSTS misconfig, configured email, a known victim address, and a proxy that forwards the hostile Host header; UI:R for the victim click; C/I:H via token disclosure and account takeover.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.
AnalysisAI
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's email address to request a reset email with a forged Host header, causing the generated reset link to point at an attacker-controlled system; when the victim follows the link, the reset token is disclosed and the attacker can reset the victim's password and fully take over the account. Exploitation is narrowly gated: the installation must enable email-based password reset (FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST), must run a professional license, and must have configured the Django ALLOWED_HOSTS setting with the wildcard '*'; installs with ALLOWED_HOSTS pinned to real domain names are not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the SysReptor installation to have password-reset-by-email enabled (FORGOT_PASSWORD_ENABLED + LOCAL_USER_AUTH_ENABLED) with a configured email gateway (EMAIL_HOST) AND ALLOWED_HOSTS set to the wildcard '*' - this specific misconfiguration is the crux; installs with ALLOWED_HOSTS pinned to real domain names are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), driving a HIGH rating on the strength of unauthenticated network reach plus high confidentiality and integrity impact (reset-token disclosure leading to full account takeover). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to SysReptor 2026.58 or later, which is the vendor-released patch that also disables the forgot-password-by-email feature whenever ALLOWED_HOSTS is unrestricted and logs a warning when '*' remains configured. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SysReptor deployments and confirm whether any run a version prior to 2026.58 with FORGOT_PASSWORD_ENABLED and LOCAL_USER_AUTH_ENABLED enabled, EMAIL_HOST configured, a professional license, and Django ALLOWED_HOSTS set to '*'; if the wildcard is present, immediately replace it with explicit trusted domain names and disable email-based password reset or the local user authentication path if not business-essential. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today