PT-2025-43524 · Unknown+1 · Levlaz Braindump+1

Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-61132

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions levlaz braindump version 0.4.14

Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to manipulate the Host header during password reset link generation, specifically when Flask's url for( external=True) is used without a defined SERVER NAME. Successful exploitation can lead to password reset poisoning and subsequent account takeover. The vulnerable component is the password reset functionality. The url for() function is used to generate reset links.

Recommendations Versions prior to 0.4.14 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-61132

Affected Products

Flask

Levlaz Braindump

References · 10

• https://osv.dev/vulnerability/CVE-2025-61132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61132 · Security Note
• https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/templates/auth/email/reset_password.html#L1-L8 · Note
• https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/auth/views.py#L131-L148 · Note
• https://twitter.com/cracbot/status/1983126644589244701 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981417836716143065 · Twitter Post
• https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning · Note
• https://gist.github.com/BrookeYangRui/94c3bee0c2cbc1ed81a21d4448550c21 · Note
• https://twitter.com/CVEnew/status/1981383865147998462 · Twitter Post
• https://drive.google.com/file/d/1FmkctLdOTGMdy6GgLaTzfxemdVDeiA7J/view?usp=sharing · Note