PT-2026-23511 · Unknown · @Perfood/Couch-Auth

Published 2026-03-05 · Updated 2026-04-27 · CVE-2025-70948

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @perfood/couch-auth version 0.26.0

Description A host header injection flaw exists in the mailer component. This allows attackers to obtain reset tokens and potentially take over accounts by manipulating the HTTP Host header. The affected component is used for authentication.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider validating and sanitizing the Host header before processing it within the mailer component.

Fix

Special Elements Injection

Weakness Enumeration

CWE-644

CWE-74

Related Identifiers

CVE-2025-70948

GHSA-QW8V-34WW-6Q9P

Affected Products

@Perfood/Couch-Auth

References · 12

• https://osv.dev/vulnerability/GHSA-qw8v-34ww-6q9p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-70948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70948 · Security Note
• https://github.com/perfood/couch-auth · Note
• https://gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e · Note
• https://twitter.com/VulmonFeeds/status/2029704958241612205 · Twitter Post
• https://t.me/cveNotify/154489 · Telegram Post
• https://twitter.com/TheHackerWire/status/2030599359843467708 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2048843927818568008 · Twitter Post
• https://twitter.com/CVEnew/status/2031137192949723551 · Twitter Post
• https://npmjs.com/package/@perfood/couch-auth · Note
• https://twitter.com/HunterXReda/status/2033596144601710991 · Twitter Post