VULNERABILITY INTELLIGENCE

CVE-2025-70948

CVSS score9.3 CRITICAL

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-03-05

Last modified2026-06-17

Description

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.