PT-2025-42474 · Unknown · Felixriddle Dev-Jobs-Handlebars

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-61536

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions FelixRiddle dev-jobs-handlebars version 1.0

Description The software uses absolute password-reset links that rely on the untrusted req.headers.host header and enforces the http:// scheme. This allows an attacker who can control the Host header, or exploit a misconfigured proxy or load balancer, to manipulate the reset links to point to attacker-controlled domains or be delivered via insecure HTTP. This can lead to token theft, phishing, and account takeover. The vulnerable parameter is req.headers.host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-61536

Affected Products

Felixriddle Dev-Jobs-Handlebars

References · 8

• 🔥 https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61536 · Exploit
• https://osv.dev/vulnerability/CVE-2025-61536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61536 · Security Note
• https://github.com/FelixRiddle/dev-jobs-handlebars · Note
• https://twitter.com/VulmonFeeds/status/1978905481021169665 · Twitter Post
• https://t.me/CVEtracker/35094 · Telegram Post
• https://twitter.com/CVEnew/status/1978932571070513218 · Twitter Post
• https://t.me/cveNotify/139000 · Telegram Post