A critical vulnerability in Piwigo 15.6.0 enables attackers to perform password reset poisoning by manipulating the Host header, potentially leading to unauthorized account access.

This vulnerability, categorized as CWE-640, occurs because the application fails to validate the hostname used to construct password reset URLs. An unauthenticated attacker can supply a malicious Host header to redirect reset links to an attacker controlled domain, facilitating credential theft.

The ability to manipulate password reset URLs poses a significant risk to user account security and data confidentiality. With a CVSS score of 8.1, the vulnerability is considered High, as it allows an attacker to intercept legitimate reset tokens. This could lead to full account takeover, unauthorized access to private photo galleries, and potential loss of sensitive user information.

Immediate Action: Upgrade to Piwigo version 15.7.0 or later, which contains the necessary fix for Host header validation.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing unexpected or suspicious Host headers directed at the password reset endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and validate the Host header in incoming requests, ensuring it matches the expected domain of the application.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the potential for account takeover and the availability of a proof-of-concept, administrators should prioritize updating to version 15.7.0 immediately. Ensuring that the application environment properly validates all incoming request headers is critical to preventing this and similar injection-based attacks.