CVE-2026-32616 - Vulnerability Analysis

Overview

Pigeon < 1.0.201 contains an open redirect caused by unvalidated use of $_SERVER['HTTP_HOST'] in email verification URL construction, letting attackers manipulate Host header to redirect users, exploit requires sending crafted HTTP requests.

Severity & Score

Impact

Attackers can redirect verification links to attacker-controlled domains, enabling account takeover via stolen email tokens.

Mitigation

Update to version 1.0.201 or later.

References

• https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201
• https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner