Sub2API Password Reset Poisoning Vulnerability Leading to Account Takeover

A password reset poisoning vulnerability has been identified in Sub2API versions prior to 0.1.85. This issue arises from a trust problem with the Host Header and Forwarded Header, allowing attackers to manipulate the password reset link by injecting their own domain. Exploitation of this vulnerability could lead to account takeover.

Impact

Exploitation allows for password reset link manipulation, potentially leading to unauthorized account access.

Remediation

Users are advised to upgrade to Sub2API version 0.1.85 or later. If an immediate upgrade is not possible, the 'forgot password' feature can be disabled temporarily to prevent exploitation until the upgrade is completed.