Threats tagged 'ghsa-8gqf-76mr-8wvc'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	8.6	CVE-2026-1270882FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison High8.62026-11-13GCVE DatabaseCVE-2026-127088 2FAuth versions prior to 9.0.1 have a vulnerability in the password recovery process that allows unauthenticated attackers to manipulate reset links by forging the HTTP Host header. This enables attackers to request recovery emails containing tokens with attacker-controlled hosts, potentially leading to account takeover and exposure of stored TOTP/HOTP secrets. Report on CVE-2026-127088 Vulnerability CWE-640 #ghsa-8gqf-76mr-8wvc	GCVE Database	2026-11-13

Page 1 of 1