An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
References
| Link | Resource |
|---|---|
| http://daylight.com | Not Applicable |
| http://fuelcms.com | Product |
| https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Login.php | Product |
| https://pentest-tools.com/PTT-2025-029-Password-Reset-Poisoning-via-Host-Header.pdf | Exploit Third Party Advisory |
Configurations
History
23 Apr 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2:*:*:*:*:*:*:* | |
| First Time |
Thedaylightstudio
Thedaylightstudio fuel Cms |
|
| References | () http://daylight.com - Not Applicable | |
| References | () http://fuelcms.com - Product | |
| References | () https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Login.php - Product | |
| References | () https://pentest-tools.com/PTT-2025-029-Password-Reset-Poisoning-via-Host-Header.pdf - Exploit, Third Party Advisory |
16 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CWE | CWE-640 |
16 Apr 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-16 15:17
Updated : 2026-04-23 15:15
NVD link : CVE-2026-30459
Mitre link : CVE-2026-30459
CVE.ORG link : CVE-2026-30459
JSON object : View
Products Affected
thedaylightstudio
- fuel_cms
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password