CVE-2026-32616

Pigeon has a Host Header Injection in email verification flow

CVSS 8.2 HIGHEPSS 0.2%CWE-74

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected products

kasuganosoras · Pigeon

References

https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201 https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr