Threats tagged 'ghsa-2x54-phff-qr64'

MRBS versions prior to 1.13.0 have a password reset poisoning vulnerability that allows unauthenticated attackers to forge the Host header when the $url_base configuration is unset. This enables attackers to cause password reset emails to contain links pointing to attacker-controlled hosts, potentially capturing reset keys and taking over user accounts, including administrators.