CVE-2022-22691

CVE-2022-22691 is a high-severity vulnerability affecting Umbraco CMS, where the password reset component uses the request host header to construct password reset URLs. This allows an attacker to manipulate the URL sent to users, potentially redirecting them to an attacker-controlled server to disclose their password reset token. The vulnerability has a CVSS score of 7.4 (HIGH), indicating it can be exploited remotely with low complexity, requiring user interaction, and leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.