A password reset poisoning vulnerability in Kovah LinkAce allows unauthenticated attackers to perform full account takeovers by manipulating HTTP headers.

The application incorrectly trusts the X-Forwarded-Host header when generating password reset links, enabling an unauthenticated attacker to redirect the reset token to an external domain.

Successful exploitation of this vulnerability leads to total account compromise, granting an attacker unauthorized access to sensitive archived links and user data. Given the CVSS score of 8.1, this flaw presents a high risk to organizational confidentiality and integrity, potentially resulting in significant data breaches and loss of control over the self-hosted platform.

Immediate Action: Update the LinkAce installation to version 2.5.4 or later immediately to incorporate the fix for header validation.

Proactive Monitoring: Review web server and application logs for suspicious requests containing modified or unusual X-Forwarded-Host headers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to validate or strip the X-Forwarded-Host header, ensuring it matches the expected internal host configuration.

Public Exploit Available: No (exploit_available: false)

The severity of this flaw necessitates immediate attention, as it provides a direct path for attackers to gain administrative or user-level access to the LinkAce archive. All administrators must prioritize the update to version 2.5.4 to prevent potential account takeovers and secure their self-hosted environments against this critical vector.