Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Description

ApostropheCMS’s password reset flow constructs the reset URL using req.hostname, which is derived directly from the attacker-controlled HTTP Host header when apos.baseUrl is not explicitly configured.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.29.0

References

• GHSA-gf43-24g3-5hw2
• CVE-2026-45013
• CWE-20
• CWE-640
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
• Parse Server has a query condition depth bypass via pre-validation transform pipeline - CVE-2026-33498
• Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input - CVE-2026-33891
• ejs vulnerable to DoS due to weak input validation - CVE-2017-1000189

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

apostrophe