rootpwn

critical · CVSS v3 8.1

CVE-2026-81179

SysReptor, a pentest reporting platform, has a critical flaw that allows an attacker to hijack password reset links via a Host header inject

Overview

SysReptor, a pentest reporting platform, has a critical flaw that allows an attacker to hijack password reset links via a Host header injection when ALLOWED_HOSTS is set to a wildcard. This can lead to account takeover if the victim follows the forged link. The issue is fixed in version 2026.58.

Description

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.

Impact

Confidentiality, Integrity, and Availability are at risk: attackers can gain unauthorized access to user accounts, compromising sensitive data and potentially disrupting reporting services. Defenders should treat this as a high-impact vulnerability affecting all installations with email-based password reset enabled.

Remediation

Upgrade to SysReptor 2026.58 or later. If upgrade is not possible, disable password reset by email or set ALLOWED_HOSTS to a strict list of trusted domains. Ensure the email gateway is properly configured and monitor for suspicious reset emails.

Risk context

Severity is critical with CVSS 8.1. No EPSS data available. Immediate action is recommended due to potential account takeover.

Affected products

  • SysReptor

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
8.1
CVSS v4
—
EPSS
—

password-reset host-header account-takeover critical email misconfiguration

← All CVEs

Related CVEs

critical

CVE-2026-81321

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.

View analysis

critical

CVE-2026-85497

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

View analysis

critical

CVE-2026-63374

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

View analysis

critical

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.

View analysis