CVE-2026-32616 - Vulnerability Analysis

Overview

Pigeon < 1.0.201 contains an open redirect caused by unvalidated use of $_SERVER['HTTP_HOST'] in email verification URL construction, letting attackers manipulate Host header to redirect users, exploit requires sending crafted Host header.

Severity & Score

Impact

Attackers can redirect email verification links to attacker-controlled domains, potentially leading to account takeover.

Mitigation

Update to version 1.0.201 or later.

References

• https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.201
• https://github.com/kasuganosoras/Pigeon/security/advisories/GHSA-rrj4-9wgq-prcr

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-32616 - High (8.2) Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $_SERVER['HTTP_HOST'] without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host he... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32616/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner