CVE-2025-53373 — Natours has a 1 Click Account take over on reset password via Host Header injection
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /for…
Published: 2025-07-07 · CVSS: 8.9 · CVSS 4.0
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7