{"id":"CVE-2026-129134","summary":"MRBS before 1.13.0 Password Reset Poisoning via Host Header Injection","details":"MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing the reset key when opened to take over accounts including administrators.","aliases":["GHSA-73cv-hx7f-9v27"],"modified":"2026-11-14T02:47:33.008596471Z","published":"2026-11-13T16:23:34.805Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"1.13.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"range":[{"fixed":"1.13.0"}],"source":"DESCRIPTION"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-640"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129134.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129134.json"},{"type":"ARTICLE","url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/lib/MRBS/Auth/AuthDb.php#L613"},{"type":"FIX","url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"type":"ADVISORY","url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"},{"type":"ADVISORY","url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-73cv-hx7f-9v27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129134"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-password-reset-poisoning-via-host-header-injection"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meeting-room-booking-system/mrbs-code","events":[{"introduced":"0"},{"fixed":"92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"fixed":"383c98214deed41ee05ce2cd3e7a57c3f72a0af0"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"92f6f5610072ddb9e1b38074c410fc8be56947ed"}]},{"source":"REFERENCES_TAG","original_tag":"v1.13.0","range":[{"fixed":"383c98214deed41ee05ce2cd3e7a57c3f72a0af0"}]}]}}],"versions":["v1.12.3","v1.12.2","v1.11.6","v1.11.5","v1.11.2","v1.11.1","mrbs-1_11_0","mrbs-1_9_4","mrbs-1_9_3","mrbs-1_9_2","mrbs-1_9_1","mrbs-1_9_0","mrbs-1_8_0","mrbs-1_7_2","mrbs-1_7_1","mrbs-1_7_0","mrbs-1_6_0","mrbs-1_5_0","mrbs-1_4_11","mrbs-1_4_10","mrbs-1_4_9","mrbs-1_4_8","mrbs-1_4_7","mrbs-1_4_6","mrbs-1_4_5","mrbs-1_4_5rc2","mrbs-1_4_5rc1","mrbs-1_4_4_1","mrbs-1_4_4","mrbs-1_4_3","mrbs-1_4_2","mrbs-1_4_2rc1","mrbs-1_4_1","mrbs-1_4","mrbs-1_4beta2","mrbs-1_4beta1","mrbs-1_4_b1","mrbs-1_2_6_1","mrbs-1_2_6","mrbs-1_2_5","mrbs-1_2_4","mrbs-1_2_3","mrbs-1_2_2","mrbs-1_2_1","mrbs-1_2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129134.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}