CVE-2026-26747: 
NixOS vulnerability analysis and mitigation

CVE-2026-26747 is a Host Header Poisoning (Password Reset Poisoning) vulnerability in Monica version 4.1.2, a popular open-source Personal Relationship Management (PRM) application. The flaw allows unauthenticated remote attackers to manipulate password reset emails by injecting a malicious HTTP Host header, redirecting victims to attacker-controlled domains and enabling full account takeover. It was reported to the vendor and MITRE on February 10, 2026, with CVE assignment on February 19, 2026, and public disclosure on February 20, 2026. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Feedly, PoC Research).

The root cause is classified as CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax). The vulnerability exists in app/Providers/AppServiceProvider.php, where the boot() method only enforces a fixed application URL via URL::forceRootUrl() when app.force_url is explicitly set to true. Because the default configuration in config/app.php sets 'force_url' => (bool) env('APP_FORCE_URL', false), the application falls back to dynamically generating absolute URLs — including password reset links — using the attacker-supplied HTTP Host header. No authentication is required to exploit this; an attacker simply intercepts or crafts a POST request to /forgot-password and substitutes the Host header with their own domain. A public proof-of-concept is available (PoC Research).

Successful exploitation leads to full account takeover (ATO): when a victim clicks the poisoned password reset link, their secret reset token is transmitted to the attacker's server, allowing the attacker to reset the victim's password on the legitimate Monica instance. This results in high confidentiality impact (unauthorized access to all personal relationship data stored in the victim's account) and high integrity impact (ability to modify or delete account data). Availability is not directly affected. Because Monica stores sensitive personal and relationship data, account compromise can expose private notes, contact details, and interaction histories (PoC Research, Feedly).

A public proof-of-concept exploit is available on GitHub, published on February 25, 2026 (PoC Research). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The vulnerability requires no authentication and has low attack complexity, making it accessible to a wide range of attackers. The EPSS score is approximately 0.053% (0.000530), indicating a currently low but non-negligible probability of exploitation. CVE-2026-26747 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify publicly accessible Monica 4.1.2 instances using search engines, Shodan, or Censys by fingerprinting the Monica login/forgot-password page.
2. Identify target account: Obtain or guess the victim's registered email address on the Monica instance.
3. Initiate password reset: Navigate to the /forgot-password endpoint and submit the victim's email address to trigger a password reset email.
4. Intercept and modify the request: Using a proxy tool such as Burp Suite, intercept the HTTP POST request to /forgot-password and replace the Host header with an attacker-controlled domain (e.g., attacker.com):

   POST /forgot-password HTTP/1.1
   Host: attacker.com
   Content-Type: application/json
   
   {"email":"victim@example.com"}

5. Victim receives poisoned email: Monica generates a password reset email containing a link such as http://attacker.com/reset-password/[TOKEN]?email=victim%40example.com and sends it to the victim.
6. Capture the reset token: When the victim clicks the link, their browser sends a request to attacker.com, where the attacker logs the incoming request and extracts the [TOKEN] value.
7. Account takeover: The attacker uses the captured token to submit a valid password reset request to the legitimate Monica instance, setting a new password and gaining full access to the victim's account (PoC Research).

• Network: Outbound HTTP/HTTPS requests from the Monica server to unexpected external domains during password reset operations; DNS lookups for non-legitimate domains originating from the Monica application server.
• Logs: Monica application/mail logs showing password reset emails sent with reset links pointing to domains other than the configured APP_URL (e.g., [2026-02-20 04:35:25] production.DEBUG: Reset Password: http://attacker.com/reset-password/...); multiple password reset requests for the same email address in a short time window.
• Application Behavior: Password reset tokens being consumed (invalidated) shortly after issuance without a corresponding successful login from the legitimate user's IP address; user accounts with recently changed passwords that the legitimate user did not initiate.
• Configuration: APP_FORCE_URL environment variable absent or set to false in the Monica .env file, confirming the vulnerable default configuration (PoC Research).

Administrators should immediately update Monica beyond version 4.1.2 to a patched release. As an immediate workaround for those unable to upgrade, set the following values in the Monica .env file to prevent the application from trusting the user-supplied Host header:

• Set APP_URL=https://monica.yourdomain.com (your actual domain)
• Set APP_FORCE_URL=true

Additionally, if Monica is deployed behind a reverse proxy (e.g., Nginx, Apache), configure the proxy to enforce and restrict the Host header to only the legitimate application domain, rejecting requests with unexpected Host values. Developers should consider changing the default value of force_url to true in config/app.php or implementing strict Host header validation against an allowlist (PoC Research, Feedly).

The vulnerability was covered by The Hacker Wire and noted in the GCVE database shortly after disclosure. A Bluesky post from The Hacker Wire's account highlighted the issue to the security community. The Spanish national cybersecurity agency INCIBE-CERT also published an early warning advisory. No major vendor statements beyond the patch availability have been issued, and community reaction has been moderate given the niche user base of Monica (Feedly).