An attacker who can control the HTTP Host header during a password reset or account creation request can cause the application to send a confirmation link that points to a domain chosen by the attacker. When a user opens the link, the reset token is included in a request to the attacker‑controlled domain, exposing the token to the attacker. The attacker can then use the stolen token to log into the affected IRRd instance, gaining full access to the account and the ability to modify RPSL objects and perform other privileged actions. The vulnerability is mitigated for users with two‑factor authentication enabled for override accounts, but ordinary accounts remain vulnerable.

This flaw exists in the IRRd daemon from the irrdnet project, version 4 of the Internet Routing Registry database server. It affects all installations of IRRd 4.4.0 through (but not including) 4.4.5 and 4.5.0 through (but not including) 4.5.1. The issue was fixed in release 4.4.5 and again in 4.5.1, which patch the host‑header handling in the web UI.

The vulnerability has a CVSS score of 8.1, indicating a high severity. The exploitation probability is low, with an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. Likely attack vectors involve remotely manipulating the Host header in HTTP requests sent to the web interface; based on the description, the attacker does not need privileged credentials to begin the attack. Once the reset link is poisoned, the attacker can acquire a valid authentication token and take over the account if two‑factor authentication is not enforced.