CVE-2025-69240 Header Poisoning in Raytha CMS
Attackers can spoof headers to send password reset links to their domain, capturing tokens to take over victim accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-69240?
CVE-2025-69240 is a high-severity vulnerability in Raytha, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account.
This issue was fixed in version 1.4.6.
Weakness: CWE-348
Which versions are affected by CVE-2025-69240?
It affects 1 product.
Products include Raytha Raytha.
How do I fix CVE-2025-69240?
No fix has been published for CVE-2025-69240 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-69240 being exploited?
There is no known exploitation of CVE-2025-69240 in the wild and no public exploit code.
Other vulnerabilities in Raytha
Sources
Also known as GHSA-qj5q-vmr2-gmq3.