CVE-2025-63828: 
PHP 脆弱性の分析と軽減

A Host Header Injection vulnerability has been identified in Backdrop CMS version 1.32.1 (CVE-2025-63828). The vulnerability allows attackers to manipulate the Host header in password reset requests, which can lead to redirects to malicious domains and potential session hijacking through cookie injection. This vulnerability was recently published and added to the NVD database on November 18, 2025 (NVD).

The vulnerability exists in the password reset functionality of Backdrop CMS 1.32.1. It specifically involves the manipulation of the Host header during password reset requests. The issue stems from improper validation of the Host header, which can be exploited to perform malicious redirects and potential session hijacking attacks (MITRE).

The successful exploitation of this vulnerability can lead to multiple security risks. Attackers can redirect users to malicious domains during password reset attempts and potentially hijack user sessions through cookie injection. This could result in unauthorized access to user accounts and compromise of user data (NVD).