CVE-2026-32616

Pigeon has a Host Header Injection in email verification flow

CVSS 8.2 HIGHEPSS 0.2%CWE-74

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.2EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Produtos afetados

kasuganosoras · Pigeon

Referências

https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201 https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr