Skip to content
Threat Feed
Subscribe

Tag

Host-Header-Injection

1 brief RSS
high advisory

Tandoor Recipes Host Header Injection Vulnerability (CVE-2026-33149)

Tandoor Recipes versions up to 2.5.3 use a wildcard for ALLOWED_HOSTS, making Django accept any HTTP Host header without validation, which allows an attacker to manipulate server-generated absolute URLs and potentially compromise user accounts through invite link poisoning.

Tandoor Recipes host-header-injection cve-2026-33149 web-application
2r 1t