MRBS · CVE-2026-129134 · Package
NO FIX YET · SEE WHAT TO DO
MRBS (a meeting room booking system) before 1.13.0 builds password reset links from the request's Host header when $url_base is unset. An unauthenticated attacker can make a reset email point to their own host and capture the reset key when the victim opens it, taking over the account, including administrator accounts.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
MRBS instances below 1.13.0 where $url_base is not configured are exposed, since the reset link host comes from the forged Host header. Instances that set $url_base explicitly are not affected by this path. unknown for any further conditions, as the sources do not say.
Not affected if url-base-set
Who cares mrbs, php, self-hosted
1.13.0 are in the affected range.$url_base is set in the MRBS configuration; it is unset in the affected case.1.13.0 or later.MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing the reset key when opened to take over accounts including administrators.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.