The vulnerability arises from Monica’s careless use of the HTTP Host header when generating absolute URLs in app/Providers/AppServiceProvider.php. Because the default configuration has app.force_url set to false, the framework accepts the client‑supplied Host header and inserts it into all generated URLs, including those that appear in password‑reset emails. A remote attacker can send a request with a malicious Host header, causing the password‑reset link to contain an attacker‑controlled domain. The victim, unwittingly clicking the link, can be redirected to a phishing site or have their credentials harvested. This flaw permits the attacker to gain unauthorized access to user accounts without needing to exploit additional vulnerabilities.

The flaw affects the open‑source CRM product Monica version 4.1.2. The affected package is identified by cpe:2.3:a:monicahq:monica:4.1.2. No other versions or products are listed. Operators running that specific release should verify whether a newer safe release is available.

The CVSS score of 9.1 indicates high severity. The EPSS score of less than 1% signifies that, at present, the likelihood of exploitation is low, and the issue is not referenced in the CISA Known Exploited Vulnerabilities database. Nonetheless, this flaw can be exploited by a remote attacker over the network by supplying a malicious Host header when initiating a password‑reset request. The attacker does not need privileged access or to compromise the underlying operating system; the attack simply redirects the victim to a spoofed domain where credentials can be phished.