CVE-2026-50635: LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Define the optional allowedHosts allowlist with the legitimate hostnames so password-reset links cannot use an attacker-controlled Host header.
LimeSurvey allowedHosts = defined allowlist of legitimate hostnames
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50635?
The severity of CVE-2026-50635 is rated as high with a score of 8.7.
How does CVE-2026-50635 affect LimeSurvey?
CVE-2026-50635 allows attackers to exploit the password reset functionality by injecting malicious Host headers, potentially disclosing sensitive reset tokens.
How do I fix CVE-2026-50635?
To fix CVE-2026-50635, configure the allowedHosts allowlist in LimeSurvey's configuration to define and restrict valid hostnames.
What are the potential impacts of CVE-2026-50635?
The potential impacts of CVE-2026-50635 include unauthorized access to user accounts and exposure of sensitive information such as reset tokens.
Is there a workaround for CVE-2026-50635?
A temporary workaround for CVE-2026-50635 is to disable the password reset feature until a proper fix is applied.