CubeCart e‑commerce software built a constant store URL directly from the HTTP Host header without an allowlist. By sending an unauthenticated POST request with a malicious Host header, an attacker can cause the application to issue a new password‑reset verification token and embed the forged URL in an email sent to a known user. When the user clicks the link, the token is accepted by the legitimate store, giving the attacker control of that user’s account or even the entire store if an admin email is targeted. The flaw involves improper input validation and insecure use of the Host header, leading to a high‑severity compromise of confidentiality and integrity for affected accounts.

CubeCart version 6.6.x through 6.7.1 released by the CubeCart vendor. The vulnerability is fixed in version 6.7.2; older builds are impacted.

The CVSS score of 8.1 indicates high severity. There is no published EPSS score, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only a crafted HTTP request and the knowledge of a target email address, the threat is significant and achievable without authentication, making mitigation a priority.