CVE-2026-33149 - Vulnerability Analysis

Overview

Tandoor Recipes <= 2.5.3 contains a host header injection caused by setting ALLOWED_HOSTS='*' allowing attackers to manipulate server-generated absolute URLs, letting attackers poison invite links, exploit requires sending crafted Host headers.

Severity & Score

Impact

Attackers can poison invite links to steal invite tokens, enabling unauthorized access to the application.

Mitigation

Update to the latest version with proper ALLOWED_HOSTS validation.

References

• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-x636-4jx6-xc4w

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner