CVE-2025-61536 Details

A host header injection vulnerability has been identified in FelixRiddle dev-jobs-handlebars version 1.0. This issue arises because the application generates password reset links using the untrusted 'Host' header from the request, without proper validation. The vulnerability is further compounded by the application forcing the 'http://' scheme, which could lead to the injection of malicious domains into the reset links. An attacker who can manipulate the 'Host' header, or exploit a misconfigured proxy or load balancer that forwards the header unchanged, could cause the reset links to point to an attacker-controlled domain or be sent via insecure HTTP. This exploitation could result in token theft, phishing attacks, and account takeover.