A critical Host header injection vulnerability in Tandoor Recipes allows attackers to redirect sensitive invite tokens to malicious servers, potentially leading to unauthorized account access.

The application incorrectly sets ALLOWED_HOSTS to a wildcard value by default, which enables an attacker with high privileges to manipulate absolute URLs generated by the system. This specifically affects invite link generation, allowing for the interception of authentication tokens via crafted HTTP Host headers.

Successful exploitation allows an attacker to intercept administrative invite links, which can result in unauthorized access to the application and compromise of administrative accounts. Given the CVSS score of 8.1, this vulnerability poses a significant risk to the integrity and confidentiality of the platform, as it facilitates account takeover through social engineering or interception of legitimate workflows.

Immediate Action: As no patch is currently identified, administrators should manually override the ALLOWED_HOSTS configuration in the Django settings to restrict access to authorized hostnames only.

Proactive Monitoring: Review web server access logs for anomalous HTTP Host headers and monitor invite link generation patterns for signs of unexpected redirect targets.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter incoming HTTP requests, specifically blocking requests that contain suspicious or non-compliant Host header values.

Public Exploit Available: Unknown

This vulnerability represents a high-risk security oversight in the application configuration. Security teams must prioritize modifying the application settings to enforce strict host validation immediately, as this is the primary mechanism to neutralize the attack vector until an official vendor patch is released.