A host header injection flaw in SysReptor allows an unauthenticated attacker to inject a malicious Host value when the password‑reset feature is enabled and ALLOWED_HOSTS is set to a wildcard. The injected header causes the application to embed the attacker‑controlled URL in a reset email. If a victim follows this link, the reset token is exposed and the attacker can reset the victim’s password, resulting in full account compromise. The weakness is identified as CWE-807.

Syslifters SysReptor installations running a version earlier than 2026.58 with password‑reset‑by‑email enabled and ALLOWED_HOSTS configured as a wildcard are affected. The problem is mitigated in release 2026.58 and later.

The vulnerability has a CVSS score of 8.1 and is not listed in the CISA KEV catalog. The EPSS score is not available, indicating insufficient data on current exploitation prevalence. Exploitation requires a functional email gateway and a victim email address; some reverse‑proxy setups may reject the malicious Host header. The attack vector is therefore remote, unauthenticated, and relies on the web application’s handling of the Host header.