CVE-2025-66509: LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66509?
CVE-2025-66509 has been classified as a high severity vulnerability due to its potential for allowing attackers to redirect sensitive reset tokens.
How do I fix CVE-2025-66509?
To fix CVE-2025-66509, ensure you update LaraDashboard to version 2.3.1 or later to mitigate the vulnerability.
What impact does CVE-2025-66509 have on my application?
CVE-2025-66509 could allow attackers to compromise password reset functionality, leading to unauthorized access to administrator accounts.
Who is affected by CVE-2025-66509?
CVE-2025-66509 affects all versions of LaraDashboard up to and including 2.3.0.
Is there a workaround for CVE-2025-66509 while waiting for a patch?
As a temporary workaround for CVE-2025-66509, you should review and restrict allowed Host headers in your server configuration.