CVE-2025-61536

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-16 · updated 2026-06-17
Weakness: CWE-620

Description

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.

References

https://github.com/FelixRiddle/dev-jobs-handlebars/
https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61536

Get alerted when CVE-2025-61536 or the next vulnerability affects your stack