Pigeon uses the HTTP Host header without validation when creating email verification URLs in the register and resendmail flows. An attacker can inject a malicious Host header in a request, causing the verification link that is emailed to the user to point to an attacker-controlled domain. When the victim clicks the link, the attacker can capture the verification token and complete the account takeover. This flaw is a classic Host Header Injection, classified as CWE-74.

The vulnerability affects the Pigeon message board/notepad/system from kasuganosoras. Any deployment of Pigeon with a version prior to 1.0.201 is susceptible. Version 1.0.201 and later contain the fix. No other products are listed.

The CVSS score of 8.2 indicates high severity and the flaw is exploitable remotely via a crafted HTTP request. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation is low and it is not yet listed in the KEV catalog. The risk remains significant for systems that have not been upgraded because an attacker who can forge the Host header can obtain an email verification token and take over legitimate user accounts.