CVE-2021-25980 is a Host Header Injection vulnerability affecting Talkyard versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1, and specific tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular releases. This high-severity vulnerability (CVSS 8.8) allows an unauthenticated attacker to take over a victim's account by tricking them into clicking a malicious link, leveraging the "forgot password" functionality. While the attack requires user interaction, its low complexity and high impact on confidentiality, integrity, and availability are significant. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.04.01, <= 0.6.74-wip-63220cbCPE matchmatch criteria | cpe:2.3:a:talkyard:talkyard:*:*:*:*:*:*:*:* | ||
>= 0.2020.22-wip-b2e97fe0e, <= 0.2021.02-wip-879ef3fe1CPE matchmatch criteria | cpe:2.3:a:talkyard:talkyard:*:*:*:*:*:*:*:* | ||
>= tyse-v0.2021.02-879ef3fe1-regular, <= tyse-v0.2021.28-af66b6905-regularCPE matchmatch criteria | cpe:2.3:a:talkyard:talkyard:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.