CVE-2026-45055

CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

State: Published
Severity: 8.1 High
Published: May 13, 2026
Updated: May 14, 2026
Reserved: May 8, 2026

Description

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in User::passwordRequest() (and the admin equivalent in Admin::passwordRequest()). An unauthenticated attacker who knows a target email can POST /index.php?_a=recover with Host: evil.com; CubeCart writes a fresh verify token (valid 3,600 s) and emails the victim a link http://evil.com/index.php?_a=recovery&validate=<TOKEN>. The token is valid against the legitimate store — capturing the victim's click on evil.com yields full account takeover, or store takeover when an admin email is targeted. This vulnerability is fixed in 6.7.2.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-345 Insufficient Verification of Data Authenticity
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Affected Products

Product	Versions
v6cubecart	< 6.7.2Affected

References

https://github.com/cubecart/v6/security/advisories/GHSA-7pvc-gxc4-chmc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.