CVE-2026-50635: LimeSurvey Password Reset Link Vulnerability Due to Unvalidated Host Header
Summary
CVE-2026-50635: LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. Affects limesurvey/limesurvey versions < 7.0.0-beta1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LimeSurvey is an open-source online survey application that allows users to create and manage surveys. It is widely used for collecting data and feedback from respondents. The application provides features such as customizable surveys, response tracking, and data analysis tools. However, it has a vulnerability that arises from the way it handles password reset requests, specifically related to the HTTP Host header.
Vulnerability Detail
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The default configuration does not define an allowedHosts allowlist, leading to a situation where the check for allowed hosts is effectively bypassed. This allows a remote, unauthenticated attacker to submit a forgotten-password request with a spoofed Host header. As a result, LimeSurvey sends an email containing a reset link with an attacker-controlled hostname, embedding a genuine validation_key. If the recipient or an automated mail-security scanner accesses this link, the valid reset token is exposed to the attacker, who can then use it to take over the account by setting a new password.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the password reset functionality until the application is updated. Additionally, you can implement a reverse proxy or web application firewall that validates the Host header before requests reach LimeSurvey.
Conclusion
The vulnerability identified as CVE-2026-50635 in LimeSurvey poses a significant risk due to the unvalidated Host header in password reset links. It is crucial for users to update to the latest version and configure their settings appropriately to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for limesurvey/limesurvey →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
An attacker can gain unauthorized access to user accounts by exploiting this vulnerability, potentially leading to data breaches and loss of sensitive information.
Yes, you can temporarily disable the password reset functionality or implement a reverse proxy to validate the Host header.
If immediate updates are not possible, ensure that you have implemented workarounds and monitor your application closely for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for limesurvey/limesurvey.
