CVE-2025-53373: Natours API Auth Bypass Vulnerability

CVE-2025-53373 Overview

CVE-2025-53373 is a host header injection vulnerability in Natours, an open-source Tour Booking API. The flaw allows an unauthenticated attacker to take over any victim account by manipulating the Host header when requesting the /forgetpassword endpoint. The application uses the attacker-controlled host value to construct the password reset link, redirecting victims to an attacker-controlled domain that captures the reset token. The vulnerability is tracked under CWE-640: Weak Password Recovery Mechanism for Forgotten Password. A fix is available in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.

Critical Impact
Unauthenticated attackers can hijack arbitrary user accounts by poisoning password reset emails through Host header manipulation, leading to full account takeover.

Affected Products

Natours Tour Booking API (open-source project by ahmed-elgaml11)
All versions prior to commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b
Deployments exposing the /forgetpassword endpoint over HTTP/HTTPS

Discovery Timeline

2025-07-07 - CVE-2025-53373 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53373

Vulnerability Analysis

The vulnerability resides in the password reset workflow exposed by the /forgetpassword endpoint. When a user requests a password reset, the application generates a reset token and embeds it in a URL sent to the user's registered email address. The Natours implementation builds this URL by reading the incoming Host header from the HTTP request rather than using a server-side configured canonical hostname.

An attacker submits a password reset request for a victim's email address while overriding the Host header with a domain they control. The victim then receives a legitimate reset email, but the embedded link points to the attacker's domain. When the victim clicks the link, the reset token is delivered to the attacker's server, allowing the attacker to complete the password reset and seize the account.

Because the endpoint requires no authentication, the attack scales to any registered email address and requires no user interaction beyond clicking the reset link the victim was expecting.

Root Cause

The root cause is improper trust in client-supplied HTTP headers. The password reset handler uses req.headers.host (or an equivalent framework helper) when constructing the reset URL without validating it against an allowlist of permitted hostnames or a fixed application base URL. This is a classic instance of [CWE-640].

Attack Vector

The attack is delivered over the network with no privileges or user interaction required to trigger token generation. An attacker issues a crafted HTTP POST request to /forgetpassword with the victim's email in the body and a malicious Host header value. The server returns success and emails the victim a reset link pointing to the attacker-controlled host. The vulnerability manifests entirely in server-side URL construction. See the GitHub Security Advisory GHSA-8gmw-7p75-58qv for full details.

Detection Methods for CVE-2025-53373

Indicators of Compromise

Inbound HTTP requests to /forgetpassword where the Host header does not match the canonical application hostname.
Outbound password reset emails containing reset URLs pointing to unexpected or unknown domains.
Spikes in /forgetpassword requests originating from a small set of source IPs targeting many distinct accounts.
Reset tokens being consumed from IP addresses or user agents that differ from the original requester.

Detection Strategies

Inspect web server and application logs for Host header values that deviate from the production hostname allowlist.
Correlate /forgetpassword request volume with successful password changes to surface anomalous reset flows.
Implement application-layer logging that records the full Host, X-Forwarded-Host, and Referer headers for authentication-related endpoints.

Monitoring Recommendations

Configure WAF rules to block or alert on requests where Host does not match an explicit allowlist.
Alert on reset emails generated for accounts that did not initiate the request, captured via user-reported phishing reports.
Monitor for /forgetpassword requests from automated tooling signatures and from network ranges not typical of the user base.

How to Mitigate CVE-2025-53373

Immediate Actions Required

Update the Natours codebase to include commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b or later.
Force a password reset for any users who received suspicious reset emails since deployment.
Invalidate all outstanding password reset tokens to neutralize tokens that may already be in attacker hands.
Audit reverse proxy and load balancer configurations to ensure they normalize or strip untrusted Host and X-Forwarded-Host headers.

Patch Information

The maintainer published the fix in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b. The patch removes reliance on the request-supplied Host header when constructing the password reset URL and replaces it with a server-controlled base URL. Operators running forked or self-hosted instances of Natours must rebase or cherry-pick this commit and redeploy.

Workarounds

Set a fixed APP_BASE_URL environment variable and use it to construct all outbound URLs instead of req.headers.host.
Enforce a Host header allowlist at the reverse proxy or WAF layer, rejecting requests with unexpected values.
Validate X-Forwarded-Host only when originating from trusted proxy IPs and discard it otherwise.
Disable the /forgetpassword endpoint until the patched commit is deployed if exposure cannot be mitigated upstream.

bash

# Example NGINX configuration enforcing a Host header allowlist
server {
    listen 443 ssl;
    server_name natours.example.com;

    if ($host !~* ^(natours\.example\.com)$) {
        return 444;
    }

    location /forgetpassword {
        proxy_set_header Host natours.example.com;
        proxy_pass http://natours_backend;
    }
}