e107, a content management system, contains a Host Header Injection flaw in the password reset process that exists in all releases prior to 2.3.4. An attacker can supply a forged Host header when requesting a password reset, and the CMS uses that header to build the reset URL. The resulting link points to an attacker‑controlled domain, allowing the victim to be duped into submitting credentials to a malicious site. This flaw can directly compromise account validity, confidentiality and integrity, and leads to phishing and account takeover.

The vulnerability affects e107 installations from e107 Inc. that are running any version older than 2.3.4. All packages that rely on the default password‑reset page before the 2.3.4 fix are susceptible, regardless of the specific minor revision numbers.

The flaw scores a CVSS of 8.1, indicating high severity. While the EPSS score is not available, the score evidences a significant threat. No known public exploit is listed in the KEV catalog, but the attack can be carried out by any external user who can request a password reset for a target account, making it a practical risk for exposed services. The exploit path requires only an HTTP request with a crafted Host header, with no special authentication or privileges.