A high-severity Host header injection vulnerability in the Pigeon application allows unauthenticated attackers to perform account takeovers by manipulating verification emails.

The application improperly validates the HTTP Host header when constructing email verification URLs during registration and password recovery flows. This vulnerability allows an unauthenticated attacker to inject a malicious domain into verification links, potentially leading to the theft of verification tokens.

The ability for an attacker to hijack the account registration or recovery process poses a significant threat to user data privacy and platform integrity. By redirecting users to attacker-controlled sites, the vulnerability enables account takeovers, potentially leading to unauthorized access to sensitive user information. Given the CVSS score of 8.2, this issue presents a substantial risk that could result in reputational damage and widespread account compromises.

Immediate Action: Upgrade the Pigeon installation to version 1.0.201 or later, which contains the necessary validation logic to prevent Host header manipulation.

Proactive Monitoring: Review application access logs for anomalous HTTP requests that contain suspicious or unexpected Host header values.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to validate and restrict the Host header to authorized domains only, effectively blocking malicious requests before they reach the application.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk to user identity security within the Pigeon platform. Administrators should prioritize the update to version 1.0.201 immediately to close the injection vector. Failure to patch allows for trivial exploitation that could lead to widespread unauthorized account access.