Vulnerability · Published Mar 13, 2026 · Assigned by GitHub_M

CVE-2026-32616Pigeon has a Host Header Injection in email verification flow

High 8.2

In plain English

A high-severity injection in Pigeon from kasuganosoras. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.

Affected products (as reported)

Vendor	Product	Versions
kasuganosoras	Pigeon	< 1.0.201

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr x_refsource_CONFIRM
https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201 x_refsource_MISC