CVE-2026-40905: LinkAce Auth Bypass Vulnerability

CVE-2026-40905 Overview

CVE-2026-40905 is a password reset poisoning vulnerability affecting LinkAce, a self-hosted archive application for collecting website links. The vulnerability exists in versions prior to 2.5.4 and allows attackers to hijack password reset tokens through manipulation of the X-Forwarded-Host HTTP header. This improper trust of user-controlled HTTP headers enables a complete account takeover scenario without requiring any prior authentication.

Critical Impact
Attackers can intercept password reset tokens and gain full account takeover by manipulating HTTP headers during the password reset flow.

Affected Products

LinkAce versions prior to 2.5.4
Self-hosted LinkAce deployments using password reset functionality
Environments where X-Forwarded-Host headers are not properly validated

Discovery Timeline

2026-04-21 - CVE CVE-2026-40905 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40905

Vulnerability Analysis

This vulnerability represents a classic password reset poisoning attack (CWE-601: URL Redirection to Untrusted Site). The core issue stems from the application's improper handling of the X-Forwarded-Host header when constructing password reset URLs.

When a user requests a password reset, the application generates a reset link containing a unique token. However, instead of using a configured trusted domain, the application dynamically incorporates the value from the X-Forwarded-Host header into the URL generation logic. This design flaw allows an attacker to inject their own domain into the password reset email sent to the victim.

The attack requires user interaction—the victim must click on the malicious reset link. Once clicked, the legitimate password reset token is transmitted to the attacker-controlled server, enabling the attacker to complete the password reset process and take over the victim's account.

Root Cause

The root cause of this vulnerability is the application's implicit trust of the X-Forwarded-Host HTTP header when generating password reset URLs. This header is typically set by reverse proxies and load balancers, but it can be trivially spoofed by attackers in direct requests. The application fails to validate this header against a whitelist of trusted domains before incorporating it into security-sensitive URL generation.

Attack Vector

The attack is network-based and follows this sequence:

An attacker identifies a target user's email address associated with a LinkAce account
The attacker initiates a password reset request for the victim's account
During the request, the attacker injects a malicious X-Forwarded-Host header pointing to their controlled domain
The application generates a password reset email containing a link to the attacker's domain with a valid reset token
When the victim clicks the link, the reset token is sent to the attacker's server
The attacker uses the captured token to reset the victim's password and gain account access

The attack can be executed through a simple HTTP request manipulation. When the victim initiates or an attacker triggers a password reset, the X-Forwarded-Host header value is used to construct the reset URL. By setting this header to an attacker-controlled domain like attacker.com, the resulting password reset email will contain a link such as https://attacker.com/password/reset/[TOKEN] instead of the legitimate application domain. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40905

Indicators of Compromise

Unusual X-Forwarded-Host header values in password reset endpoint access logs
Multiple password reset requests originating from the same IP address for different user accounts
Password reset completion from IP addresses different from the request origin
User reports of password reset emails containing unfamiliar domain names

Detection Strategies

Implement monitoring rules to alert on password reset requests with non-standard X-Forwarded-Host headers
Log and analyze all password reset endpoint traffic for header manipulation attempts
Deploy web application firewall (WAF) rules to detect and block suspicious header values
Monitor for patterns of password reset requests followed by rapid account access from new locations

Monitoring Recommendations

Enable detailed access logging for authentication-related endpoints
Configure alerts for password reset requests with X-Forwarded-Host headers not matching trusted domains
Track password reset token usage patterns to identify potential token theft scenarios
Implement anomaly detection for account access following password resets

How to Mitigate CVE-2026-40905

Immediate Actions Required

Upgrade LinkAce to version 2.5.4 or later immediately
Review access logs for any suspicious password reset activity prior to patching
Force password resets for any accounts where compromise is suspected
Notify users about the vulnerability and encourage them to verify recent account activity

Patch Information

The vulnerability has been addressed in LinkAce version 2.5.4. The fix ensures that password reset URLs are generated using a trusted, configured domain rather than user-controllable HTTP headers. Organizations should upgrade to this version or later to remediate the vulnerability. For additional details, see the GitHub Security Advisory.

Workarounds

Configure your reverse proxy or load balancer to strip or sanitize the X-Forwarded-Host header before forwarding requests to LinkAce
Implement network-level restrictions to limit password reset endpoint access to trusted IP ranges
Deploy a WAF rule to block requests containing unexpected X-Forwarded-Host header values
Consider temporarily disabling the password reset functionality until the patch can be applied

bash

# Example nginx configuration to strip X-Forwarded-Host header
# Add to your nginx server block for LinkAce
proxy_set_header X-Forwarded-Host $host;
# This ensures the header is always set to the legitimate host value