CVE-2026-35507 describes a Host header injection vulnerability affecting Shynet versions prior to 0.14.0, specifically within its password reset functionality. This medium-severity flaw (CVSS 6.4) has a network attack vector but requires high attack complexity and user interaction, potentially leading to limited confidentiality and availability, but high integrity impact. There is currently no evidence of active exploitation, nor are public exploit codes available, though it has received some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.13.1CPE matchmatch criteria | cpe:2.3:a:shynet:shynet:*:*:*:*:*:*:*:* | ||
>= 0, < 0.14.0CPE match | cpe:2.3:a:milesmcc:shynet:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.