Password Reset Poisoning Vulnerability in LinkAce by Kovah

CVE-2026-40905

What is CVE-2026-40905?

LinkAce, a self-hosted link archiving application by Kovah, has a vulnerability that allows an attacker to manipulate the X-Forwarded-Host header during password reset requests. This leads to the generation of malicious password reset URLs containing an attacker-controlled domain. When users receive such emails and click the malicious link, they inadvertently send their password reset token to the attacker's server, facilitating unauthorized account access and complete takeover of the victim's account. The issue has been addressed in LinkAce version 2.5.4.

References