LinkAce Password Reset Flaw: Account Takeover Risk

The National Vulnerability Database (NVD) reports a critical password reset poisoning vulnerability, CVE-2026-40905, in LinkAce versions prior to 2.5.4. This self-hosted link archiving application is susceptible due to its improper handling of user-controlled HTTP headers, specifically X-Forwarded-Host.

Attackers can exploit this by manipulating the X-Forwarded-Host header during a password reset request. This injects an attacker-controlled domain into the password reset link sent to the victim. When the victim clicks this malicious link, their password reset token is unwittingly transmitted to the attacker’s server. This allows the attacker to capture the token, reset the victim’s password, and achieve full account takeover.

With a CVSS score of 8.1 (HIGH), this vulnerability poses a significant risk. Defenders running LinkAce must prioritize upgrading to version 2.5.4 immediately. This isn’t theoretical; it’s a direct path to compromise, leveraging a common web application misconfiguration pattern. Don’t assume your reverse proxy or load balancer mitigates this if LinkAce itself trusts the header.