A critical vulnerability in Webmin 2.510 allows unauthenticated attackers to manipulate password reset emails and hijack user accounts.

The application is susceptible to host header injection within the forgot_send.cgi script. This flaw allows an unauthenticated attacker to manipulate the HTTP Host header to redirect password reset tokens to a malicious domain.

This vulnerability poses a significant risk to organizational security by enabling full account takeover. Given the CVSS score of 7.1, this is a high-severity issue that could lead to unauthorized access to administrative interfaces, potential data exfiltration, or complete system compromise. The ability to intercept password reset tokens bypasses standard authentication controls, posing a direct threat to the integrity of the Webmin environment.

Immediate Action: Upgrade Webmin to the version containing the patch, or apply the official security update provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous HTTP Host headers or unusual traffic patterns directed at the forgot_send.cgi endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules to validate and restrict the Host header to expected, authorized domain names.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up linked in the references.

The vulnerability in Webmin 2.510 is a serious concern that requires immediate attention from security administrators. Because this flaw allows for the hijacking of accounts through the password reset mechanism, the risk of unauthorized access to the Webmin management console is high. Organizations should verify their current version and apply the vendor-supplied fix as soon as possible to prevent potential account takeover attempts.