CVE-2025-70948

CRITICAL

@perfood/couch-auth 0.26.0 - Host Header Injection

Title source: llm
STIX 2.1

Description

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

References (3)

Core 3

Scores

CVSS v3 9.3
EPSS 0.0001
EPSS Percentile 2.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-644
Status published
Products (1)
perfood/couch-auth 0npm
Published Mar 05, 2026
Tracked Since Mar 06, 2026