CVE-2026-32616

Pigeon has a Host Header Injection in email verification flow

CVSS 8.2 HIGHEPSS 0.2%CWE-74

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 mar 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Productos afectados

kasuganosoras · Pigeon

Referencias

https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201 https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr