7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62527

CVE-2025-62527: Taguette password reset link poisoning

Impact

An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim.

Patches

Users should upgrade to Taguette 1.5.0.

References

https://gitlab.com/remram44/taguette/-/issues/331

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62527

CVE-2025-62527:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
taguette	pip	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a password reset link poisoning issue in Taguette. The analysis started by identifying the patched version (1.5.0) and the last vulnerable version (1.4.1) from the provided information. By comparing the commits between these two versions, I was able to pinpoint the exact code changes that addressed the vulnerability.

The key commit, b56a67962c526981e18929438d1213c87c96b2a5, revealed a change in taguette/web/views.py. Specifically, in the post method of the ForgotPassword class, the code was changed from using self.request.host to self.application.config['DOMAIN'] when generating the password reset link. This is a direct mitigation for a host header injection vulnerability.

The vulnerable function is ForgotPassword.post. Before the patch, it used the Host header from the incoming request to construct the password reset link. An attacker could manipulate this header to point to a domain they control. If a user requested a password reset through a request forged by an attacker, the email they received would contain a link to the attacker's domain. Clicking this link would expose the password reset token to the attacker, allowing them to change the user's password and gain unauthorized access to their account.

The fix involves another commit, 7c8961e1500808ef0246732ea4f47ffe509d609c, which introduces a new configuration setting, DOMAIN. This setting provides a trusted, static domain name to be used for generating links, thus preventing the poisoning attack. The vulnerable function was then updated to use this secure configuration value instead of the untrusted input from the Host header.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62527: Taguette password reset link poisoning

Impact

Patches

References

CVE-2025-62527:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

7.1

7.1

Basic Information

Basic Information

CVE-2025-62527: Taguette password reset link poisoning

Impact

Patches

References

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI