CVE-2026-81179

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.

• CWE-807

• https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea
• https://github.com/Syslifters/sysreptor/releases/tag/2026.58
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-9x2r-5pff-8w6c

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81166Missing Authorization vulnerability in Drupal Digital Signag…5.3
• CVE-2026-81167Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2026-81168Authentication Bypass Using an Alternate Path or Channel vul…3.7
• CVE-2026-8117A security vulnerability has been detected in SourceCodester…4.3
• CVE-2026-81176Svelte devalue is a JavaScript library that serializes value…5.3
• CVE-2026-81178SysReptor is a fully customizable pentest reporting platform…3.5
• CVE-2026-8118The Royal Addons for Elementor – Addons and Templates Kit fo…6.5
• CVE-2026-81180SysReptor is a fully customizable pentest reporting platform…8.8
• CVE-2026-81181SysReptor is a fully customizable pentest reporting platform…3.7
• CVE-2026-81182SysReptor is a fully customizable pentest reporting platform…4.2
• CVE-2026-8119A vulnerability was detected in Open5GS up to 2.7.7. Impacte…5.5
• CVE-2026-81192`OpenTelemetry.Resources.Host` NuGet package, which provides…7