CVE-2025-43933

Name of the Vulnerable Software and Affected Versions: fblog versions through 983bede

Description: The issue allows account takeover via the password reset feature because the SERVER NAME is not configured, causing the reset to depend on the Host HTTP header.

Recommendations: For versions through 983bede, configure the SERVER NAME to prevent the password reset feature from relying on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.