Raytha CMS is vulnerable to header poisoning. An attacker can spoof the X-Forwarded-Host or Host headers to control the domain to which the system sends password‑reset emails. When a victim receives the email, the reset link points to the attacker‑controlled domain. Clicking that link causes the victim’s browser to send the password‑reset token to the attacker’s domain, where the attacker can capture it and reset the victim’s account, fully compromising the account. The flaw is a header‑poisoning weakness (CWE‑348) that allows remote abuse of the password‑reset mechanism.

The affected vendor is Raytha for the product Raytha. Versions before 1.4.6 are vulnerable; the issue is fixed in Raytha 1.4.6 and later releases.

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, suggesting a currently low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack appears to be initiated via the web interface. An attacker must know or obtain a victim’s email address to trigger the password‑reset flow and rely on the victim clicking the forged link, after which the attacker can capture the token and take over the account.