p PatchFirst

CVE-2026-50635

CVE-2026-50635 · LimeSurvey Password Reset Host Header Injection Discloses Reset Token

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.

CVSS 8.7 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • limesurvey

    Versions
    • ≥ 0, ≤ 7.0: Affected (custom)
    • 7.0.1: Not affected (custom)

    Update to 7.0.1

  • limesurvey/limesurvey Packagist

    Versions
    • 1.0.4
    • 2.2.5
    • 2.65.2+170606
    • 2.65.3+170607
    • 2.65.4+170612
    • 2.65.5+170613
    • 2.65.6+170615
    • 2.66.6+170619
    • 2.67.0+170622
    • 2.67.1+170626
    • 2.67.2+170728
    • 2.67.3+170728
    • 2.70.0+170921
    • 2.71.0+170925
    • 2.71.1+170927
    • 2.72.0+171010
    • 2.72.1+171012
    • 2.72.2+171017
    • 2.72.3+171020
    • 2.72.4+171110
    • 2.72.5+171121
    • 2.72.6+171207
    • 2.73.0+171219
    • 2.73.1+171220
    • 3.0.0+171222
    • 3.0.0-RC.1
    • 3.0.0-RC.2+171102
    • 3.0.0-RC.3+171114
    • 3.0.0-beta.1+170720
    • 3.0.0-beta.2+170810
    • 3.0.0-beta.3+170914
    • 3.0.1+171228
    • 3.0.2+180110
    • 3.0.3+180112
    • 3.0.4+180116
    • 3.0.5+180118
    • 3.1.0
    • 3.1.1+180130
    • 3.10.0+180611
    • 3.11.0+180612
    • 3.12.0+180615
    • 3.12.1+180616
    • 3.12.2+180625
    • 3.12.3+180627
    • 3.13.0+180628
    • 3.13.1+180629
    • 3.13.2+180709
    • 3.14.0+180730
    • 3.14.1+180731
    • 3.14.10+180926
    • 3.14.11+180926
    • 3.14.2+180807
    • 3.14.4+180810
    • 3.14.5+180815
    • 3.14.6+180821
    • 3.14.7+180827
    • 3.14.8+180829
    • 3.14.9+180917
    • 3.15.0+181008
    • 3.15.1+181017
    • 3.15.2+181107
    • 3.15.3+181108
    • 3.15.4+181109
    • 3.15.5+181115
    • 3.15.6+190108
    • 3.15.7+190124
    • 3.15.8+190130
    • 3.15.9+190214
    • 3.16.1+190314
    • 3.17.0+190402
    • 3.17.1+190408
    • 3.17.10+190821
    • 3.17.11+190822
    • 3.17.12+190823
    • 3.17.13+190824
    • 3.17.14+190902
    • 3.17.15+190903
    • 3.17.16+190906
    • 3.17.17+190918
    • 3.17.3+190429
    • 3.17.4+190529
    • 3.17.5+190604
    • 3.17.6+190624
    • 3.17.7+190627
    • 3.17.8+190722
    • 3.17.9+190731
    • 3.18.0+190923
    • 3.19.0+191008
    • 3.19.1+191009
    • 3.19.2+191017
    • 3.19.3+191023
    • 3.2.0+180206
    • 3.2.1+180207
    • 3.20.0+191112
    • 3.20.1+191114
    • 3.20.2+191119
    • 3.21.0+191203
    • 3.21.1+191210
    • 3.21.2+191216
    • 3.21.3+191219
    • 3.21.4+200108
    • 3.21.5+200115
    • 3.21.6+200121
    • 3.22.0+200127
    • 3.22.1+200129
    • 3.22.10+200323
    • 3.22.11+200330
    • 3.22.12+200406
    • 3.22.13+200415
    • 3.22.14+200423
    • 3.22.15+200505
    • 3.22.16+200519
    • 3.22.17+200525
    • 3.22.18+200603
    • 3.22.19+200605
    • 3.22.2+200204
    • 3.22.20+200617
    • 3.22.21+200622
    • 3.22.210+200804
    • 3.22.22+200625
    • 3.22.23+200626
    • 3.22.24+200630
    • 3.22.25+200706
    • 3.22.26+200714
    • 3.22.27+200720
    • 3.22.28+200728
    • 3.22.29+200731
    • 3.22.3+200211
    • 3.22.4+200212
    • 3.22.5+200218
    • 3.22.6+200219
    • 3.22.7+200225
    • 3.22.8+200309
    • 3.22.9+200317
    • 3.23.0+200813
    • 3.23.1+200825
    • 3.23.2+200908
    • 3.23.3+200909
    • 3.23.4+200922
    • 3.23.5+200923
    • 3.23.6+200929
    • 3.23.7+201006
    • 3.24.0+201013
    • 3.24.1+201014
    • 3.24.2+201020
    • 3.24.3+201027
    • 3.24.4+201103
    • 3.24.5+201104
    • 3.24.6+201109
    • 3.25.0+201117
    • 3.25.1+201124
    • 3.25.10+210128
    • 3.25.11+210210
    • 3.25.12+210211
    • 3.25.13+210216
    • 3.25.14+210218
    • 3.25.15+210223
    • 3.25.16+210302
    • 3.25.17+210309
    • 3.25.18+210316
    • 3.25.19+210323
    • 3.25.2+201131
    • 3.25.20+210330
    • 3.25.21+210407
    • 3.25.22+210413
    • 3.25.3+201208
    • 3.25.4+201215
    • 3.25.5+201222
    • 3.25.6+201229
    • 3.25.7+210113
    • 3.25.8+210118
    • 3.25.9+210125
    • 3.26.0+210419
    • 3.26.1+210427
    • 3.26.2+210503
    • 3.26.3+210511
    • 3.26.4+210517
    • 3.26.5+210519
    • 3.27.0+210525
    • 3.27.1+210531
    • 3.27.10+210803
    • 3.27.11+210809
    • 3.27.12+210816
    • 3.27.13+210823
    • 3.27.14+210831
    • 3.27.15+210907
    • 3.27.16+210909
    • 3.27.17+210911
    • 3.27.18+210921
    • 3.27.19+210928
    • 3.27.2+210608
    • 3.27.20+211012
    • 3.27.21+211021
    • 3.27.22+211026
    • 3.27.23+211102
    • 3.27.24+211108
    • 3.27.25+211116
    • 3.27.26+211123
    • 3.27.27+211130
    • 3.27.28+211208
    • 3.27.29+211214
    • 3.27.3+210615
    • 3.27.30+211222
    • 3.27.31+220104
    • 3.27.32+220119
    • 3.27.33+220125
    • 3.27.34+220132
    • 3.27.35+220208
    • 3.27.4+210622
    • 3.27.5+210624
    • 3.27.6+210629
    • 3.27.7+210713
    • 3.27.8+210721
    • 3.27.9+210726
    • 3.28.1+220229
    • 3.28.10+220510
    • 3.28.11+220517
    • 3.28.12+220524
    • 3.28.13+220531
    • 3.28.14+220608
    • 3.28.15+220616
    • 3.28.16+220621
    • 3.28.17+220627
    • 3.28.18+220706
    • 3.28.19+220712
    • 3.28.2+220308
    • 3.28.20+220719
    • 3.28.21+220726
    • 3.28.22+220802
    • 3.28.23+220809
    • 3.28.24+220816
    • 3.28.25+220822
    • 3.28.26+220829
    • 3.28.27+220905
    • 3.28.28+220912
    • 3.28.29+220920
    • 3.28.3+220315
    • 3.28.30+220927
    • 3.28.31+221005
    • 3.28.32+221011
    • 3.28.33+221020
    • 3.28.34+221021
    • 3.28.35+221025
    • 3.28.36+221102
    • 3.28.37+221108
    • 3.28.38+221115
    • 3.28.39+221122
    • 3.28.4+220329
    • 3.28.40+221129
    • 3.28.41+221206
    • 3.28.42+221213
    • 3.28.43+221221
    • 3.28.44+230110
    • 3.28.45+230117
    • 3.28.46+230124
    • 3.28.47+230131
    • 3.28.48+230207
    • 3.28.49+230215
    • 3.28.5+220405
    • 3.28.50+230221
    • 3.28.51+230228
    • 3.28.52+230307
    • 3.28.53+230314
    • 3.28.54+230321
    • 3.28.55+230328
    • 3.29.0

    No fix published

Original sources

Check your server →