Raytha CMS contains a critical host header spoofing vulnerability that allows unauthenticated attackers to perform full account takeovers.

The application fails to properly validate the X-Forwarded-Host or Host headers, allowing an unauthenticated attacker to inject a malicious domain into password reset emails. By tricking a victim into clicking this link, the attacker captures the reset token and gains unauthorized access to the user account.

This vulnerability poses a significant risk of account takeover, which can lead to unauthorized access to sensitive user data, identity theft, and potential administrative compromise depending on the victim's privileges. With a CVSS score of 8.8, this flaw is considered High severity, as it facilitates a direct path to credential theft and system-wide account manipulation.

Immediate Action: Upgrade Raytha CMS to version 1.4.6 or later immediately to resolve the header validation flaw.

Proactive Monitoring: Monitor outgoing email logs for unusual patterns in password reset requests and review web server access logs for anomalous Host header values.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to strictly validate the Host header against a whitelist of authorized domains to prevent spoofing attempts.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the potential for complete account takeover, this vulnerability should be treated with high urgency. Administrators must prioritize updating to version 1.4.6 to eliminate the risk of host header injection, as this is the only definitive way to secure the password reset mechanism.