# CVE-2026-81179: SysReptor password reset link hijacking via Host header

Source: https://junglewise.ai/threats/cve-2026-81179-sysreptor-is-a-fully-customizable-pentest-reporting-platform  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81179 · Severity: high · CVSS 8.1 · Published 2026-09-18

SysReptor is a pentest reporting platform that organizations use to generate and manage security assessment reports. When password reset by email is enabled with a wildcard ALLOWED_HOSTS configuration, an attacker can intercept the password reset email and forge a malicious Host header to redirect the victim to an attacker-controlled site that captures the reset token, enabling account takeover.

Technologies: [Syslifters SysReptor](https://junglewise.ai/threats/technologies/sysreptor). Vendors: [Syslifters](https://junglewise.ai/threats/vendors/syslifters).

## Quick answers

**Is CVE-2026-81179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81179 being exploited in the wild.

**How severe is CVE-2026-81179?** High severity, with a CVSS score of 8.1, published 18 September 2026.

**Which products and versions are affected?** Syslifters SysReptor before 2026.58.

**Is there a fix for CVE-2026-81179?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81179 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81179?** Check whether you run Syslifters SysReptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Host header injection in password reset link generation. When ALLOWED_HOSTS contains a wildcard, the application accepts attacker-controlled Host headers when constructing password reset URLs sent via email. An unauthenticated attacker can trigger a reset email for any user, and if the victim clicks the malicious link, the reset token is exposed to the attacker's domain. Exploitation requires an active email gateway and valid victim email address; the fix in 2026.58 disables email password reset when ALLOWED_HOSTS is not properly configured.

## Affected products

- Syslifters SysReptor before 2026.58

## Timeline

- 2026-07-21: disclosed: Fix released in version 2026.58
- 2026-09-18: advisory: CVE-2026-81179 published

## References

- [https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea](https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea)
- [https://github.com/Syslifters/sysreptor/releases/tag/2026.58](https://github.com/Syslifters/sysreptor/releases/tag/2026.58)

## Related threats

- [SysReptor unauthorized file disclosure via shared note link](https://junglewise.ai/threats/cve-2026-81182-sysreptor-is-a-fully-customizable-pentest-reporting-platform)
- [Syslifters SysReptor privilege escalation in user management](https://junglewise.ai/threats/cve-2026-44987-syslifters-sysreptor-privilege-escalation-in-user-management)
- [Syslifters SysReptor authorization bypass in personal notes](https://junglewise.ai/threats/cve-2026-42291-syslifters-sysreptor-authorization-bypass-in-personal-notes)
- [SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site…](https://junglewise.ai/threats/cve-2025-66561-sysreptor-is-a-fully-customizable-pentest-reporting-platform)