CVE-2025-70948

An attacker sends an HTTP request with a modified 'Host' header pointing to a server controlled by the attacker. The @perfood/couch-auth mailer component uncritically uses this header value when generating the password reset link sent in an email message to the user. When the victim clicks the crafted link, the password reset token is sent to the attacker's server. Possessing the token, the attacker can reset the password and take over the victim's account.

An attacker can take full control of any application user's account who uses the password reset functionality. This leads to complete compromise of account confidentiality and integrity.

Apply patches available from the vendor according to the references. It is recommended to monitor the project repository on GitHub (https://github.com/perfood/couch-auth) and the npm package page to obtain the updated version. As a temporary measure, it is worth considering validation and enforcement of allowed 'Host' header values at the server or reverse proxy level (e.g., through a whitelist of allowed hosts).

@perfood/couch-auth library in version 0.26.0 (npm package). Applications using this library for authentication and password reset handling.