CVE-2025-70948 describes a host header injection vulnerability in @perfood/couch-auth v0.26.0's mailer component. This flaw allows attackers to spoof the HTTP Host header, enabling them to obtain password reset tokens and subsequently execute an account takeover. While no CVSS score is available, the vulnerability presents a significant risk due to the potential for complete account compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| N/A | N/A | n/aCNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.