CVE-2026-32616: Pigeon Auth Bypass Vulnerability

CVE-2026-32616 Overview

CVE-2026-32616 is a Host Header Injection vulnerability affecting Pigeon, an open-source message board/notepad/social system/blog application. Prior to version 1.0.201, the application uses $_SERVER['HTTP_HOST'] without proper validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in HTTP requests, causing verification links sent to users' email addresses to point to an attacker-controlled domain. This vulnerability can lead to account takeover by stealing email verification tokens.

Critical Impact

Attackers can steal email verification tokens through manipulated Host headers, enabling complete account takeover of newly registered users.

Affected Products

• Pigeon Message Board/Social System versions prior to 1.0.201

Discovery Timeline

• 2026-03-16 - CVE-2026-32616 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32616

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as a Host Header Injection flaw. The root issue lies in how the Pigeon application constructs email verification URLs during the user registration and email resend processes.

The application trusts the $_SERVER['HTTP_HOST'] value provided in incoming HTTP requests without performing any validation or sanitization. When a user registers an account or requests a new verification email, the application uses this potentially attacker-controlled value to build the verification URL that gets embedded in the outgoing email. An attacker who can intercept or influence the registration process can inject a malicious Host header, causing the verification link to redirect to their controlled domain instead of the legitimate application server.

Root Cause

The vulnerability stems from insufficient input validation on the HTTP Host header. The Pigeon application directly incorporates $_SERVER['HTTP_HOST'] into email verification URLs without checking whether the value matches expected or whitelisted domains. This trusts user-controllable input for constructing security-sensitive URLs, violating the principle of input validation.

Attack Vector

The attack requires network access and user interaction. An attacker must position themselves to inject a malicious Host header into HTTP requests destined for the Pigeon application. This can be accomplished through various means:

1. Man-in-the-Middle (MITM) attacks - Intercepting registration requests and modifying the Host header
2. DNS rebinding attacks - Causing the victim's browser to send requests with an attacker-controlled Host header
3. Social engineering - Tricking users into registering through specially crafted links or proxied connections

When a victim clicks the verification link in their email, their verification token is transmitted to the attacker's domain. The attacker can then use this token to verify the victim's account and potentially gain unauthorized access. The changed scope characteristic of this vulnerability means the impact extends beyond the vulnerable component to affect the user's email client and browser interactions.

Detection Methods for CVE-2026-32616

Indicators of Compromise

• Unusual or suspicious Host header values in web server access logs that don't match expected domains
• Email verification links in application logs containing unexpected or malicious domains
• User reports of verification emails containing links to unfamiliar websites
• Failed email verification attempts followed by successful verifications from different IP addresses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with Host headers that don't match configured domains
• Monitor outgoing email content for URLs containing unexpected domain names
• Set up alerting for anomalous patterns in user registration and email verification workflows
• Review access logs for requests with manipulated or suspicious Host header values

Monitoring Recommendations

• Enable detailed logging for all registration and email resend requests, capturing the full Host header
• Implement real-time monitoring for Host header anomalies across all application endpoints
• Track verification token usage patterns to identify potential token theft scenarios
• Set up alerts for verification links being clicked from unexpected geographic locations or IP ranges

How to Mitigate CVE-2026-32616

Immediate Actions Required

• Upgrade Pigeon to version 1.0.201 or later immediately
• Audit recent user registrations for signs of account compromise
• Review email verification logs for suspicious domain patterns
• Implement server-side Host header validation as a defense-in-depth measure

Patch Information

The vulnerability has been fixed in Pigeon version 1.0.201. Users should update to this version or later to remediate the vulnerability. The fix is available through the GitHub Release 1.0.201. Additional technical details are available in the GitHub Security Advisory GHSA-rrj4-9wgq-prcr.

Workarounds

• Configure the web server or reverse proxy to enforce a whitelist of allowed Host header values
• Implement application-level configuration to use a hardcoded base URL for email verification links instead of relying on the Host header
• Deploy a web application firewall (WAF) rule to reject requests with unexpected Host header values
• Consider temporarily disabling email-based registration until the patch can be applied

# Example Apache configuration to restrict Host headers
# Add to your virtual host configuration
<VirtualHost *:80>
    ServerName your-pigeon-domain.com
    # Reject requests with mismatched Host headers
    RewriteEngine On
    RewriteCond %{HTTP_HOST} !^your-pigeon-domain\.com$ [NC]
    RewriteRule ^ - [F]
</VirtualHost>