CVE-2025-52560 Kanboard Password Reset Poisoning via Host Header Injection

What is CVE-2025-52560?

CVE-2025-52560 is a high-severity vulnerability in kanboard, published on 24 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.

Weakness: CWE-640

Which versions are affected by CVE-2025-52560?

It affects 1 product.

Products include Kanboard Kanboard.

How do I fix CVE-2025-52560?

No fix has been published for CVE-2025-52560 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-52560 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52560 exists.

Other vulnerabilities in kanboard

• CVE-2026-21881 Kanboard is Vulnerable to Reverse Proxy Authentication Bypass Critical 9.1
• CVE-2025-55010 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events Critical 9.1
• CVE-2024-51747 Arbitrary File Read and Delete in kanboard Critical 9.1
• CVE-2024-51748 Remote code execution through language setting in kanboard Critical 9.1
• CVE-2017-12850 Business logic in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2ch5-gqjm-8p92.