LimeSurvey's password reset functionality relies on the HTTP Host header to build reset links. The optional allowedHosts allowlist intended to restrict acceptable Host headers is undefined by default, resulting in no validation. An attacker can exploit this by sending a password reset request for a known user with a spoofed Host header, causing the reset email to include a link with an attacker-controlled hostname embedding the genuine reset token. Accessing this link discloses the token to the attacker, who can then use it to reset the victim's password and gain account control. This vulnerability is tracked as CVE-2026-50635 and has a CVSS 3.1 score of 8.8 (high severity).

An unauthenticated remote attacker can cause LimeSurvey to send password reset emails containing attacker-controlled links with valid reset tokens. This leads to disclosure of the reset token to the attacker when the link is accessed, enabling the attacker to reset the victim's password and take over the account. The vulnerability affects confidentiality, integrity, and availability of user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider configuring the allowedHosts parameter to explicitly restrict acceptable Host headers if supported. Monitoring for suspicious password reset requests and educating users about phishing risks may help reduce impact. Do not rely on default configurations that leave allowedHosts undefined.