CVE-2021-36804

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.

• CWE-640
• CWE-640

• https://github.com/laravel/laravel/pull/5477Issue Tracking, Patch, Third Party Advisory
• https://www.laravel-enlightn.com/docs/security/host-injection-analyzer.htmlThird Party Advisory
• https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/Exploit, Third Party Advisory
• https://github.com/laravel/laravel/pull/5477Issue Tracking, Patch, Third Party Advisory
• https://www.laravel-enlightn.com/docs/security/host-injection-analyzer.htmlThird Party Advisory
• https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/Exploit, Third Party Advisory

Published

Aug 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36799KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Pass…8.8
• CVE-2021-3680showdoc is vulnerable to Missing Cryptographic Step4.9
• CVE-2021-36800Akaunting version 2.1.12 and earlier suffers from a code inj…9.1
• CVE-2021-36801Akaunting version 2.1.12 and earlier suffers from an authent…8.1
• CVE-2021-36802Akaunting version 2.1.12 and earlier suffers from a denial-o…6.5
• CVE-2021-36803Akaunting version 2.1.12 and earlier suffers from a persiste…5.4
• CVE-2021-36805Akaunting version 2.1.12 and earlier suffers from a persiste…4.8
• CVE-2021-36806 A reflected XSS vulnerability allows an open redirect when …6.1
• CVE-2021-36807An authenticated user could potentially execute code via an …8.8
• CVE-2021-36808A local attacker could bypass the app password using a race …7
• CVE-2021-36809A local attacker can overwrite arbitrary files on the system…6
• CVE-2021-3681A flaw was found in Ansible Galaxy Collections. When collect…5.5