CVE-2025-43931

Name of the Vulnerable Software and Affected Versions: flask-boilerplate versions through a170e7c

Description: The issue allows account takeover via the password reset feature. This is because the SERVER NAME is not configured, and thus the password reset depends on the Host HTTP header.

Recommendations: For versions through a170e7c, configure the SERVER NAME to prevent the password reset feature from depending on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.