CVE-2026-40905: LinkAce Auth Bypass Vulnerability

CVE-2026-40905 Overview

CVE-2026-40905 is a password reset poisoning vulnerability affecting LinkAce, a self-hosted archive application for collecting website links. The vulnerability exists in versions prior to 2.5.4 and allows attackers to hijack password reset tokens through manipulation of the X-Forwarded-Host HTTP header. This improper trust of user-controlled HTTP headers enables a complete account takeover scenario without requiring any prior authentication.

Critical Impact

Attackers can intercept password reset tokens and gain full account takeover by manipulating HTTP headers during the password reset flow.

Affected Products

• LinkAce versions prior to 2.5.4
• Self-hosted LinkAce deployments using password reset functionality
• Environments where X-Forwarded-Host headers are not properly validated

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40905 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40905

Vulnerability Analysis

This vulnerability represents a classic password reset poisoning attack (CWE-601: URL Redirection to Untrusted Site). The core issue stems from the application's improper handling of the X-Forwarded-Host header when constructing password reset URLs.

When a user requests a password reset, the application generates a reset link containing a unique token. However, instead of using a configured trusted domain, the application dynamically incorporates the value from the X-Forwarded-Host header into the URL generation logic. This design flaw allows an attacker to inject their own domain into the password reset email sent to the victim.

The attack requires user interaction—the victim must click on the malicious reset link. Once clicked, the legitimate password reset token is transmitted to the attacker-controlled server, enabling the attacker to complete the password reset process and take over the victim's account.

Root Cause

The root cause of this vulnerability is the application's implicit trust of the X-Forwarded-Host HTTP header when generating password reset URLs. This header is typically set by reverse proxies and load balancers, but it can be trivially spoofed by attackers in direct requests. The application fails to validate this header against a whitelist of trusted domains before incorporating it into security-sensitive URL generation.

Attack Vector

The attack is network-based and follows this sequence:

1. An attacker identifies a target user's email address associated with a LinkAce account
2. The attacker initiates a password reset request for the victim's account
3. During the request, the attacker injects a malicious X-Forwarded-Host header pointing to their controlled domain
4. The application generates a password reset email containing a link to the attacker's domain with a valid reset token
5. When the victim clicks the link, the reset token is sent to the attacker's server
6. The attacker uses the captured token to reset the victim's password and gain account access

The attack can be executed through a simple HTTP request manipulation. When the victim initiates or an attacker triggers a password reset, the X-Forwarded-Host header value is used to construct the reset URL. By setting this header to an attacker-controlled domain like attacker.com, the resulting password reset email will contain a link such as https://attacker.com/password/reset/[TOKEN] instead of the legitimate application domain. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40905

Indicators of Compromise

• Unusual X-Forwarded-Host header values in password reset endpoint access logs
• Multiple password reset requests originating from the same IP address for different user accounts
• Password reset completion from IP addresses different from the request origin
• User reports of password reset emails containing unfamiliar domain names

Detection Strategies

• Implement monitoring rules to alert on password reset requests with non-standard X-Forwarded-Host headers
• Log and analyze all password reset endpoint traffic for header manipulation attempts
• Deploy web application firewall (WAF) rules to detect and block suspicious header values
• Monitor for patterns of password reset requests followed by rapid account access from new locations

Monitoring Recommendations

• Enable detailed access logging for authentication-related endpoints
• Configure alerts for password reset requests with X-Forwarded-Host headers not matching trusted domains
• Track password reset token usage patterns to identify potential token theft scenarios
• Implement anomaly detection for account access following password resets

How to Mitigate CVE-2026-40905

Immediate Actions Required

• Upgrade LinkAce to version 2.5.4 or later immediately
• Review access logs for any suspicious password reset activity prior to patching
• Force password resets for any accounts where compromise is suspected
• Notify users about the vulnerability and encourage them to verify recent account activity

Patch Information

The vulnerability has been addressed in LinkAce version 2.5.4. The fix ensures that password reset URLs are generated using a trusted, configured domain rather than user-controllable HTTP headers. Organizations should upgrade to this version or later to remediate the vulnerability. For additional details, see the GitHub Security Advisory.

Workarounds

• Configure your reverse proxy or load balancer to strip or sanitize the X-Forwarded-Host header before forwarding requests to LinkAce
• Implement network-level restrictions to limit password reset endpoint access to trusted IP ranges
• Deploy a WAF rule to block requests containing unexpected X-Forwarded-Host header values
• Consider temporarily disabling the password reset functionality until the patch can be applied

# Example nginx configuration to strip X-Forwarded-Host header
# Add to your nginx server block for LinkAce
proxy_set_header X-Forwarded-Host $host;
# This ensures the header is always set to the legitimate host value