Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M
CVE-2026-40905LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover
High 8.1
In plain English
A high-severity open redirect in LinkAce from Kovah. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email containing a malicious link pointing to an attacker-controlled domain. When the victim clicks the link, the password reset token is transmitted to the attacker-controlled server. An attacker can capture this token and use it to reset the victim’s password, leading to full account takeover. This vulnerability is fixed in 2.5.4.
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/Kovah/LinkAce/security/advisories/GHSA-48wv-jpf4-vjfv x_refsource_CONFIRM