CubeCart v6.6.x to 6.7.1 improperly constructs the CC_STORE_URL constant from the Host HTTP header without an allowlist, embedding it directly into transactional emails such as password reset links. An attacker can send a password recovery request with a malicious Host header, causing the victim to receive a reset link pointing to the attacker's domain with a valid verification token. The token is valid for 3600 seconds and can be used to hijack user or admin accounts. This vulnerability is addressed in CubeCart v6.7.2.

Successful exploitation allows an unauthenticated attacker to perform account takeover of any user or administrator by tricking them into clicking a password reset link that points to a malicious domain controlled by the attacker. This leads to full compromise of user accounts or the entire store if an admin account is targeted. The vulnerability has a CVSS 3.1 score of 8.1 (high severity), reflecting its potential for confidentiality and integrity impact without requiring privileges.

This vulnerability is fixed in CubeCart version 6.7.2. Users should upgrade to version 6.7.2 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated in the vendor advisory but the description confirms the fix in 6.7.2. Until upgraded, users should be cautious of password reset emails and verify URLs carefully.