CVE-2026-50635 LimeSurvey Password Reset Host Header Injection Discloses Reset Token
Attacker exploits Host header injection in password reset emails to steal reset tokens and take over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50635?
CVE-2026-50635 is a high-severity vulnerability in LimeSurvey, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.
Weakness: CWE-640
Which versions are affected by CVE-2026-50635?
2 open source packages ship an affected version, including limesurvey/limesurvey.
| Package | Affected | Fixed in |
|---|---|---|
limesurvey/limesurvey Packagist | All versions to 7.0.0-beta1 | None |
limesurvey/limesurvey Packagist | All versions to 7.0.0-beta1 | None |
How do I fix CVE-2026-50635?
No fix has been published for CVE-2026-50635 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-50635 being exploited?
There is no known exploitation of CVE-2026-50635 in the wild and no public exploit code.
Sources
Also known as GHSA-5c37-5j7w-8mh8.