CVE-2026-32616

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification link sent to the user's email to point to an attacker-controlled domain. This can lead to account takeover by stealing the email verification token. This vulnerability is fixed in 1.0.201.

• CWE-74

• https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201
• https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32610Glances is an open-source system cross-platform monitoring t…8.1
• CVE-2026-32611Glances is an open-source system cross-platform monitoring t…9.1
• CVE-2026-32612Statamic is a Laravel and Git powered content management sys…5.4
• CVE-2026-32613Spinnaker is an open source, multi-cloud continuous delivery…9.9
• CVE-2026-32614Go ShangMi (Commercial Cryptography) Library (GMSM) is a cry…7.5
• CVE-2026-32615Discourse is an open-source discussion platform. From versio…5.4
• CVE-2026-32617AnythingLLM is an application that turns pieces of content i…7.5
• CVE-2026-32618Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-32619Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-3262A vulnerability has been found in go2ismail Asp.Net-Core-Inv…8.8
• CVE-2026-32620Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-32621Apollo Federation is an architecture for declaratively compo…9.9