CVE-2026-35507

MediumCVSS 6.4

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Host header injection vulnerability in Shynet before 0.14.0 in the password reset flow.

An attacker can exploit Host header injection to redirect the user to a malicious site during password reset, potentially stealing the reset token.

Update Shynet to version 0.14.0 or later where the vulnerability is fixed.

Original NVD description (English source)

Shynet before 0.14.0 allows Host header injection in the password reset flow.