Vulnerability in Tandoor Recipes Affects URL Handling and Security

CVE-2026-33149

What is CVE-2026-33149?

Tandoor Recipes, an application designed for recipe management and meal planning, has a vulnerability stemming from its default configuration of ALLOWED_HOSTS set to '*'. This configuration permits Django to accept arbitrary values in the HTTP Host header without proper validation. As a result, an attacker capable of sending crafted requests can manipulate server-generated absolute URLs found in various contexts, including invite emails and API responses. The most significant risk involves invite link poisoning, where an attacker can redirect a legitimate invitation request to their server, potentially capturing sensitive invite tokens from unsuspecting users.

References