PT-2026-33310 · Daylight Studio · Fuel Cms

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-30459

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Daylight Studio FuelCMS version 1.5.2

Description An issue in the Forgot Password feature allows unauthenticated attackers to obtain the password reset token of a victim user. The application fails to validate the Host header when constructing the password reset URL. An attacker can spoof this header and trigger a password reset request for a valid user email, causing the application to send a legitimate email containing a reset link that points to a server controlled by the attacker. When the victim clicks the link, the token is exfiltrated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-30459

Affected Products

Fuel Cms

References · 8

• 🔥 https://pentest-tools.com/PTT-2025-029-Password-Reset-Poisoning-via-Host-Header.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30459 · Security Note
• https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Login.php · Note
• https://i.redd.it/uocc5zj0kjvg1.png · Reddit Post
• https://twitter.com/VulmonFeeds/status/2044863697483358536 · Twitter Post
• http://fuelcms.com · Note
• http://daylight.com · Note
• https://twitter.com/CVEnew/status/2045112908838039886 · Twitter Post