CVE-2022-50910
Published: 13 January 2026
Summary
CVE-2022-50910 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Beehiveforum Beehive Forum. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2022-50910 is a host header injection vulnerability in Beehive Forum version 1.5.2, specifically within the forgot password functionality. This issue, classified under CWE-640, enables attackers to manipulate password reset requests by injecting a malicious host header, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network. By injecting a malicious host header, they can intercept password reset tokens sent to victims, allowing unauthorized password changes and full account takeover without direct authentication.
Advisories and references, including a Vulncheck advisory on Beehive Forum account takeover and an Exploit-DB entry (50923) with a public exploit, highlight the issue. The Beehive Forum project page on SourceForge and official website provide additional context, along with an Imgur-hosted proof-of-concept image. No specific patch or mitigation details are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2614
Vulnerability details
Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can inject a malicious host header to intercept password reset tokens and change victim account passwords without…
more
direct authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a host header injection in a public-facing web application (Beehive Forum), enabling remote, unauthenticated account takeover via password reset token interception without user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted inputs like the malicious Host header in forgot password requests to prevent injection and URL manipulation.
Mandates secure management of authenticators including password reset tokens to mitigate interception and unauthorized use via manipulated reset links.
Enforces boundary protection mechanisms such as web application firewalls to filter or block requests exploiting Host header injection in public-facing password reset functionality.