CVE-2026-129134

MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $urlbase is unset. Attackers can request a reset for a victim so AuthDb::notifyUser emails a link pointing to their host, capturing th...