CVE-2025-61541 Open redirect in n/a
Attackers can manipulate the Host header in password reset emails to redirect victims to a malicious site, intercepting tokens to take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-61541?
CVE-2025-61541 is a high-severity vulnerability in Webmin Webmin, published on 16 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
Weakness: CWE-284
Which versions are affected by CVE-2025-61541?
It affects 1 product.
Products include Webmin Webmin.
How do I fix CVE-2025-61541?
No fix has been published for CVE-2025-61541 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-61541 being exploited?
There is no known exploitation of CVE-2025-61541 in the wild and no public exploit code.
Other vulnerabilities in Webmin Webmin
Sources
Also known as GHSA-j92g-3wfv-qp43.