CVE-2025-43932

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2

Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header.

Recommendations: For versions through 7e7b0b2, configure the SERVER NAME to prevent the password reset feature from relying on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.