CVE-2026-26747

The Monica application generates absolute URLs (e.g., for password reset) based on the value of the HTTP Host header provided by the user, instead of using a hardcoded base address. The default configuration leaves the 'app.force_url' parameter unset (value 'false'), so the protection mechanism is not activated. An attacker can send a request to the application with a manipulated Host header pointing to a server controlled by them, which results in generating a password reset link that directs the victim to a malicious domain. The code responsible for this behavior is located in the app/Providers/AppServiceProvider.php file.

An attacker can intercept the victim's password reset token when they click on a crafted link, which consequently leads to account takeover. The vulnerability enables remote attacks without authentication and without interaction from the attacker beyond generating an appropriate request.

Patches available from the vendor should be applied in accordance with the references. As a workaround, the 'app.force_url' parameter should be explicitly configured in the application's configuration file, indicating the correct base address, which prevents the use of the Host header to generate URLs.

Monica version 4.1.2 with default configuration, where the 'app.force_url' parameter is not set (default value 'false').