Vulnerability · Published Oct 20, 2025 · Assigned by GitHub_M

CVE-2025-62527Taguette vulnerable to password reset link poisoning

High 7.1

In plain English

A high-severity security flaw in taguette from remram44. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	taguette	1.5.0	GHSA-7rc8-5c8q-jr6j
PyPI	taguette	1.5.1	PYSEC-2025-187

Affected products (as reported)

Vendor	Product	Versions
remram44	taguette	< 1.5.0

Weakness: CWE-15 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6j x_refsource_CONFIRM
https://gitlab.com/remram44/taguette/-/issues/331 x_refsource_MISC