Description

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-21T22:16:59.547Z",
  "pubdate": "2026-09-21T22:16:59.547Z",
  "executiveSummary": "Gladys Assistant versions prior to 5.1.0 are susceptible to a critical password reset link poisoning vulnerability. This flaw stems from a lack of server-side validation regarding the origin parameter within the forgot_password endpoint, allowing unauthenticated remote actors to manipulate the construction of password recovery emails.\nBy injecting an attacker-controlled origin into the request, an adversary can force the application to generate a reset link that directs a victim to an external, malicious server. Consequently, the password reset token is transmitted to the attacker, facilitating a full account takeover. The impact is critical, as this exploit can be leveraged against any user, including accounts with administrative privileges, resulting in unauthorized access to sensitive home automation data and system control. The vulnerability is entirely remote and requires no prior authentication, representing a significant risk to the confidentiality and integrity of the Gladys Assistant platform.",
  "technicalDetails": "The vulnerability resides in the forgot_password endpoint, which fails to perform rigorous server-side validation or canonicalization on the user-supplied 'origin' parameter. In the standard architecture of Gladys Assistant, this parameter is intended to construct the base URL for the password recovery link sent to users via email.\nThe root cause is a trust-based implementation error where the application relies on client-provided input to dictate the domain context of sensitive security notifications. Because the server does not enforce a whitelist of permitted origins or cross-reference the request against configured environment variables, an attacker can supply an arbitrary attacker-controlled domain.\nThe attack flow follows a predictable sequence: 1) The attacker initiates a request to the /forgot_password endpoint for a targeted victim's account. 2) Within the HTTP request body or parameters, the attacker overrides the 'origin' parameter with a domain under their control. 3) The server processes the request and generates a cryptographically valid password reset token. 4) The server constructs the reset URL by concatenating the attacker-supplied origin with the reset token and sends this email to the victim. 5) When the victim clicks the link, the browser transmits the sensitive reset token directly to the attacker's server, which logs the request.\nOnce the token is exfiltrated, the attacker can use it to reset the victim's password through the legitimate, backend-facing reset mechanism. Since the application cannot distinguish between the legitimate legitimate recovery flow and the poisoned request, the attacker successfully bypasses authentication mechanisms. The lack of validation creates a wide-reaching impact, as the attacker can perform this against any account identifier known to the system. The vulnerability is exploitable over the network without requiring any prior authentication or local access to the target instance, making it a high-utility vector for remote account takeover."
}