CVE-2025-70948: 
JavaScript vulnerability analysis and mitigation

CVE-2025-70948 is a host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 (and earlier), a Node.js/Express authentication library for CouchDB-backed applications. By spoofing the HTTP Host header in password reset or email confirmation requests, unauthenticated remote attackers can manipulate generated links to redirect reset tokens to an attacker-controlled domain, enabling full account takeover. The vulnerability was published on March 5, 2026, and carries a CVSS v3.1 base score of 9.3 (Critical) (Feedly, Security Advisory).

The root cause is classified as CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). When a user requests a password reset or email confirmation, the mailer component constructs the reset/confirmation URL using the value of the HTTP Host header from the incoming request without validation or allowlist enforcement. An attacker can forge this header (e.g., Host: attacker.com) so that the generated link in the email points to an attacker-controlled server. When the victim clicks the link, the reset token is transmitted to the attacker, who can then use it to take over the account. The affected endpoint is the POST /forgot-password route (and potentially POST /register confirmation emails). A public security advisory detailing the issue was published by researcher 0xHunterr (Security Advisory, couch-auth GitHub).

Successful exploitation allows an unauthenticated remote attacker to fully take over any user account on an application using @perfood/couch-auth v0.26.0 or earlier. The confidentiality and integrity impacts are both rated HIGH — the attacker gains unauthorized access to the victim's account and all associated data, and can make changes on the victim's behalf. Because CouchAuth manages access to CouchDB/Cloudant user databases, account takeover may also expose or corrupt user-specific database contents. Availability is not directly impacted (Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029% (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no privileges and only low-complexity network access, though it does require user interaction (the victim must click the malicious reset link) (Feedly, Security Advisory).

1. Reconnaissance: Identify web applications using @perfood/couch-auth v0.26.0 or earlier by inspecting npm dependency files, HTTP response headers, or API endpoint patterns (e.g., /auth/forgot-password, /auth/register).
2. Craft malicious request: Send a POST /auth/forgot-password request to the target application with the victim's email address in the body, and a spoofed Host header pointing to an attacker-controlled domain (e.g., Host: attacker.com).
3. Token delivery to attacker: The mailer component constructs the password reset URL using the spoofed Host value, generating a link such as https://attacker.com/auth/password-reset?token=<reset_token>. This link is emailed to the victim.
4. Capture the token: When the victim clicks the link, their browser sends a request to attacker.com, delivering the reset token to the attacker (e.g., via attacker-controlled server logs or a simple HTTP listener).
5. Account takeover: The attacker uses the captured token to POST /auth/password-reset on the legitimate application with a new password, gaining full control of the victim's account (Security Advisory, couch-auth GitHub).

• Network: Outbound password reset or confirmation emails containing URLs pointing to unexpected or external domains instead of the application's own domain; HTTP requests to /auth/forgot-password or /auth/register with a Host header value that does not match the application's configured hostname.
• Logs: Application/web server access logs showing POST /auth/forgot-password requests with anomalous Host header values (e.g., external IPs or domains); email delivery logs showing reset links sent to legitimate users but containing attacker-controlled URLs.
• Application Behavior: Unexpected password reset completions for accounts where the user did not initiate a reset; accounts with recently changed passwords that the legitimate owner did not authorize.

No official patched version has been confirmed as released at the time of publication — organizations should contact the @perfood/couch-auth maintainers via the GitHub repository or the npm package page to check for security updates. As an immediate workaround: (1) implement allowlist-based validation of the HTTP Host header in your Express middleware, rejecting requests with unexpected host values before they reach the mailer component; (2) explicitly configure the application's base URL for email link generation rather than deriving it from the request Host header; (3) audit recent password reset activity for signs of abuse; (4) consider temporarily disabling the forgot-password functionality if the risk is unacceptable (Feedly, Security Advisory).

The vulnerability was disclosed by security researcher 0xHunterr via a public GitHub Gist advisory on February 15, 2026, covering both CVE-2025-70948 and the related CVE-2025-70949 (timing discrepancy). The disclosure was noted by automated CVE tracking accounts on Bluesky and Mastodon. No significant vendor statement or major media coverage has been identified beyond the researcher's advisory and standard CVE database entries (Security Advisory).