remram44/taguette · Security
Taguette password reset link poisoning
- GHSA ID
- GHSA-7rc8-5c8q-jr6j
- CVE ID
- CVE-2025-62527
- Severity
- high
- Published
- Updated
- CVSS
- 7.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- CVSS v3
- 7.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Description
Impact
An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim.
Patches
Users should upgrade to Taguette 1.5.0.
References
CWEs
- CWE-15 · External Control of System or Configuration Setting
References
- https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6j ↗
- https://gitlab.com/remram44/taguette/-/issues/331 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-62527 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/taguette/PYSEC-2025-187.yaml ↗
- https://github.com/advisories/GHSA-7rc8-5c8q-jr6j ↗