Executive brief
SysReptor is a pentest reporting platform that organizations use to generate and manage security assessment reports. When password reset by email is enabled with a wildcard ALLOWED_HOSTS configuration, an attacker can intercept the password reset email and forge a malicious Host header to redirect the victim to an attacker-controlled site that captures the reset token, enabling account takeover.
Technical details
The vulnerability is a Host header injection in password reset link generation. When ALLOWED_HOSTS contains a wildcard, the application accepts attacker-controlled Host headers when constructing password reset URLs sent via email. An unauthenticated attacker can trigger a reset email for any user, and if the victim clicks the malicious link, the reset token is exposed to the attacker's domain. Exploitation requires an active email gateway and valid victim email address; the fix in 2026.58 disables email password reset when ALLOWED_HOSTS is not properly configured.
Affected products
- Syslifters SysReptor before 2026.58
Timeline
- 2026-07-21: disclosed: Fix released in version 2026.58
- 2026-09-18: advisory: CVE-2026-81179 published