CVE-2025-48738: StrangeBee TheHive DoS Vulnerability

CVE-2025-48738 Overview

CVE-2025-48738 is an e-mail flooding vulnerability in StrangeBee TheHive, a security incident response platform. The flaw resides in the password reset feature, which lacks rate limiting on unauthenticated requests. Remote attackers can repeatedly invoke the password reset endpoint to generate an unbounded volume of outbound e-mails to targeted user accounts. The condition maps to CWE-770 (Allocation of Resources Without Limits or Throttling). Successful abuse leads to mailbox storage exhaustion for targeted users, reputation damage to the sending SMTP server, potential SMTP blacklisting, and saturation of the outbound mail queue. Affected releases include TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1.

Critical Impact
Unauthenticated attackers can flood targeted mailboxes and saturate the SMTP infrastructure supporting TheHive, disrupting incident response operations.

Affected Products

StrangeBee TheHive 5.2.0 before 5.2.16
StrangeBee TheHive 5.3.0 before 5.3.11
StrangeBee TheHive 5.4.0 before 5.4.10
StrangeBee TheHive 5.5.0 before 5.5.1

Discovery Timeline

2025-05-23 - CVE-2025-48738 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48738

Vulnerability Analysis

TheHive exposes an unauthenticated password reset endpoint that accepts a target user identifier and triggers an outbound e-mail through the configured SMTP relay. The endpoint does not enforce request rate limits, CAPTCHA validation, or per-user throttling. An attacker can script repeated requests against a single victim address and cause TheHive to issue thousands of password reset messages in a short interval. The consequences extend beyond the targeted mailbox. The SMTP relay used by TheHive becomes the source of high-volume automated traffic, which upstream mail providers commonly interpret as abuse. This behavior can trigger inclusion of the relay in public block lists such as Spamhaus, degrading delivery for legitimate TheHive notifications including case assignments and alerts.

Root Cause

The root cause is missing resource throttling on a pre-authentication code path [CWE-770]. Password reset functionality is a well-known amplification vector because a single small HTTP request produces a comparatively expensive downstream action, an SMTP transaction and mailbox write. Without per-IP, per-account, or global rate limits, the feature can be used as an e-mail flooder.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends repeated HTTP POST requests to the password reset endpoint, supplying the victim's registered e-mail address as the target. TheHive processes each request and dispatches a reset e-mail. The vulnerability does not permit code execution or data disclosure, but it enables a denial-of-service condition against user mailboxes and the SMTP infrastructure. No exploit code is publicly listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

A working proof of concept has not been released. See the StrangeBee Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-48738

Indicators of Compromise

High volume of identical password reset e-mails delivered to a single recipient in a short window.
Repeated HTTP POST requests to TheHive's password reset endpoint originating from a single IP or a small set of IPs.
Rapid growth of the SMTP relay's outbound queue tied to messages generated by TheHive.
Appearance of the TheHive SMTP relay on public block lists such as Spamhaus or Barracuda.

Detection Strategies

Instrument the reverse proxy or web application firewall in front of TheHive to log and alert on request bursts against the password reset URI.
Correlate application logs from TheHive with SMTP server logs to detect password reset events exceeding a defined baseline per hour.
Monitor mail-server bounce rates and recipient complaints, since abuse traffic frequently generates non-delivery reports.

Monitoring Recommendations

Track requests-per-minute on unauthenticated TheHive endpoints and alert on statistical deviations.
Ingest TheHive and SMTP logs into a centralized SIEM or data lake for cross-source correlation of reset-related activity.
Alert on SMTP queue depth thresholds and on any listing of the outbound relay by reputation services.

How to Mitigate CVE-2025-48738

Immediate Actions Required

Upgrade TheHive to 5.2.16, 5.3.11, 5.4.10, or 5.5.1 or later, depending on the deployed branch.
Restrict network exposure of the TheHive web interface to trusted networks or a VPN until the upgrade is applied.
Enforce rate limiting at the reverse proxy layer on the password reset endpoint as a compensating control.
Review SMTP relay reputation and request delisting if the server appears on public block lists.

Patch Information

StrangeBee has released fixed versions in each supported branch: TheHive 5.2.16, 5.3.11, 5.4.10, and 5.5.1. Upgrade instructions and version notes are published in the StrangeBee Security Advisory SB-SEC-ADV-2025-003.

Workarounds

Configure a WAF or reverse proxy rule to limit requests to the password reset URI per source IP and per targeted e-mail address.
Add a CAPTCHA or proof-of-work challenge in front of the password reset form.
Restrict access to the TheHive login and reset pages using IP allow-listing where operationally feasible.

bash

# Example NGINX rate limit for the password reset endpoint
limit_req_zone $binary_remote_addr zone=thehive_reset:10m rate=5r/m;

location /api/v1/user/password/reset {
    limit_req zone=thehive_reset burst=5 nodelay;
    proxy_pass http://thehive_backend;
}