FullStackHero's WebAPI Boilerplate host header injection vulnerability

ALTO 8.1CVE-2024-26470 · GHSA-75x2-6h4m-h6mx · Published 29/02/2024 · updated 17/06/2026

In breve

CVE-2024-26470 è una vulnerabilità ALTO (CVSS 8.1) che riguarda FullStackHero.WebAPI.Boilerplate, .net 9 starter kit (fullstackhero).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 64.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
FullStackHero.WebAPI.Boilerplate NuGet	`≥ 1.0.0, ≤ 1.0.1`	No fix yet
.net 9 starter kit fullstackhero	`= 1.0.0= 1.0.1`	No fix yet

Description

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.

NVD description

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2024-26470 · ADVISORY
dub-flow/vulnerability-research · WEB
fullstackhero/dotnet-webapi-boilerplate · PACKAGE
nuget.org/packages/FullStackHero.WebAPI.Boilerplate · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free