CVE-2025-61536

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.

Published 2025-10-16. Last modified 2026-06-17.