CVE-2026-43935: e107 CMS Auth Bypass Vulnerability

CVE-2026-43935 Overview

CVE-2026-43935 is a Host Header Injection vulnerability in the e107 content management system (CMS) affecting versions prior to 2.3.4. The flaw resides in the password reset functionality, where the application trusts the HTTP Host header when constructing password reset links. Attackers can manipulate the Host header to generate reset links that point to attacker-controlled domains. When a victim requests a password reset and clicks the malicious link, the embedded reset token is transmitted to the attacker. This enables phishing, credential theft, and account takeover. The maintainers fixed the issue in e107 version 2.3.4.

Critical Impact
Successful exploitation allows unauthenticated attackers to hijack password reset tokens and take over user accounts, including administrator accounts.

Affected Products

e107 CMS versions prior to 2.3.4
e107 password reset component (signup.php / password recovery flow)
Deployments of e107 that rely on the HTTP Host header for URL generation

Discovery Timeline

2026-05-26 - CVE-2026-43935 published to NVD
2026-05-26 - Last updated in NVD database
Fix released - e107 version 2.3.4 contains the patched code

Technical Details for CVE-2026-43935

Vulnerability Analysis

The vulnerability is classified under [CWE-20] Improper Input Validation. e107 generates absolute URLs for password reset emails by reading the inbound HTTP Host header without validating it against an allowlist of trusted domains. Because the Host header is fully attacker-controlled in an HTTP request, an attacker can submit a password reset request on behalf of a target user and supply a Host value pointing to a domain they own.

The resulting reset email contains a link such as https://attacker.tld/reset?token=..., but the embedded token is valid for the legitimate e107 instance. When the victim clicks the link, their browser sends the secret token to the attacker. The attacker then replays the token against the real site and resets the victim's password. User interaction is required, which is reflected in the CVSS vector component UI:R, but no privileges are needed (PR:N).

Root Cause

The root cause is reliance on the unvalidated Host request header when building outbound password reset URLs. The application did not enforce a canonical site URL from server-side configuration. Any value supplied by the client was reflected into security-sensitive email content.

Attack Vector

The attack is network-based and unauthenticated. An attacker sends a crafted password reset request for a known username or email address, including a malicious Host header pointing to a domain they control. The e107 server constructs the reset URL using that header, and the victim receives an email whose reset link routes the secret token to the attacker's server. The attacker harvests the token and completes the password reset on the legitimate site.

No verified public proof-of-concept code is available. Technical details of the fix can be reviewed in the e107 GitHub Security Advisory GHSA-7pmw-jwvr-cq2x and in the upstream commits 04511f9, b0dee82, and c4f9f71.

Detection Methods for CVE-2026-43935

Indicators of Compromise

Web server access logs showing POST requests to the password reset endpoint with Host header values that do not match the canonical site domain.
Outbound password reset emails containing reset links whose domain differs from the production site.
Multiple password reset requests originating from a single IP address against distinct user accounts.
DNS or proxy logs showing user traffic to unfamiliar domains immediately after a password reset email is sent.

Detection Strategies

Inspect HTTP request logs for mismatches between the Host header and the expected production hostname on password reset routes.
Compare reset link domains in outbound mail server logs against an allowlist of approved hostnames.
Alert when the e107 password reset endpoint is invoked with X-Forwarded-Host or unusual Host values.

Monitoring Recommendations

Enable detailed logging on the e107 password reset workflow, including the raw Host header value.
Forward web server, application, and outbound SMTP logs to a centralized analytics platform for correlation.
Track sudden spikes in password reset volume per source IP or per user account.

How to Mitigate CVE-2026-43935

Immediate Actions Required

Upgrade all e107 installations to version 2.3.4 or later without delay.
Audit recent password reset activity and invalidate any tokens issued from suspicious Host headers.
Force password resets for any accounts that show evidence of token harvesting.
Restrict administrative access to the e107 backend by IP allowlist while upgrades are scheduled.

Patch Information

The vulnerability is fixed in e107 version 2.3.4. The fix is delivered through upstream commits 04511f9, b0dee82, and c4f9f71. Refer to the GitHub Security Advisory GHSA-7pmw-jwvr-cq2x for the full advisory.

Workarounds

Configure the web server (Apache, Nginx) to reject requests whose Host header does not match the canonical site hostname.
Enforce a fixed ServerName or server_name directive and disable default virtual hosts that accept arbitrary Host values.
Strip or normalize the X-Forwarded-Host header at the reverse proxy or load balancer before requests reach e107.
Harden mail templates so reset URLs are built from a server-side configuration constant rather than request data, where customization is possible.

bash

# Nginx configuration example: reject requests with an unexpected Host header
server {
    listen 443 ssl;
    server_name www.example.com;

    if ($host !~* ^(www\.example\.com)$ ) {
        return 444;
    }

    # Prevent client-supplied X-Forwarded-Host from reaching e107
    proxy_set_header X-Forwarded-Host "";
    proxy_set_header Host $host;
}