Userfrosting - Host-Header Injection Leads to Account Takeover
Priority MEDIUM 41CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Why it matters now
EPSS 0.016 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed userfrosting/userfrosting (Packagist): 4.6.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| userfrosting | userfrosting | 0.3.1 and later; up to 4.6.2 | — | No fix listed | CNA |
| — | userfrosting/userfrosting (Packagist) | 0.3.1 to before 4.6.3 | 4.6.3 | Patch available | GHSA-cv25-3gmg-c6m8 |
- userfrosting Vendoruserfrosting Affected 0.3.1 and later; up to 4.6.2 Fixed in — No fix listed CNA
- userfrosting/userfrosting (Packagist) Vendor— Affected 0.3.1 to before 4.6.3 Fixed in 4.6.3 Patch available GHSA-cv25-3gmg-c6m8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:userfrosting:userfrosting:*:*:*:*:*:*:*:* | 0.3.1 to before 4.6.3 | Vulnerable | userfrosting |
- cpe:2.3:a:userfrosting:userfrosting:*:*:*:*:*:*:*:* Versions 0.3.1 to before 4.6.3 Vulnerable ·userfrosting
Remediation
- Fix · GHSA-cv25-3gmg-c6m8 userfrosting/userfrosting (Packagist) Fixed in 4.6.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25994
- 2026-10-03 Alias added: GHSA-cv25-3gmg-c6m8
References
Sources
- CVE-2021-25994 · CVE Program
- CVE-2021-25994 · NVD
- FIRST EPSS
- GHSA-cv25-3gmg-c6m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences