CVE-2026-50635: LimeSurvey Password Reset Host Header Injection Discloses Reset Token

Synopsis

Host header injection in LimeSurvey's password-reset flow allows a remote, unauthenticated attacker to embed a genuine password-reset token inside a link pointing to an attacker-controlled hostname. The vulnerability is reachable over the network with no credentials required, but the attacker must induce the target user (or an automated mail-security scanner) to follow the crafted link. Successful exploitation gives the attacker the valid reset token, which can be replayed to set a new password and fully take over the targeted account. A patched-image rebuild at version 7.0.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the LimeSurvey password-reset endpoint over the network; the service must be exposed to the internet or a network the attacker can access.

• AuthenticationNot required

  No account or session is needed; the forgotten-password endpoint is publicly accessible and accepts unauthenticated requests.

• Victim interactionRequired

  The target user (or an automated inbound mail-security link scanner acting on behalf of the user) must dereference the crafted reset link for the token to be disclosed to the attacker.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the target's username and email are known; no race conditions or special memory layout are required.

Blast Radius

• The attacker obtains the genuine password-reset token for the targeted account and replays it to set a new password, locking out the legitimate owner.
• Full confidentiality of the compromised account is lost; the attacker can read all surveys, responses, and participant data accessible to that account.
• The attacker can modify or delete surveys, responses, and account settings, corrupting or destroying collected research data.
• If the compromised account holds admin privileges, the attacker gains administrative control over the entire LimeSurvey instance, affecting all surveys and user data hosted there.