Password Reset Poisoning Vulnerability in MRBS by Meeting Room Booking System

CVE-2026-129134

What is CVE-2026-129134?

The MRBS application prior to version 1.13.0 is susceptible to a password reset poisoning vulnerability. This flaw enables unauthorized attackers to manipulate the Host header, leading to forged reset link redirections when the $url_base variable is unset. Through this method, an attacker can request a password reset for an innocent user, and in turn, receive an email containing a reset link directed to the attacker's own host. If the victim clicks on this malicious link, the attacker gains access to the reset key, potentially compromising user accounts, including those of administrators.

References