Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2025-62527: Taguette password reset email can be hijacked
CVE-2025-62527 · published 1 year ago
Summary
Versions of Taguette before 1.5.0 let an attacker craft a password‑reset email that contains a malicious link. If a user clicks the link, the attacker can change the account's email address and take control. Update to Taguette 1.5.0 or later to close the risk.
What to do
- Update remi rampin taguette to version 1.5.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | remi rampin | taguette |
< 1.5.0 Fix: upgrade to 1.5.0
|
| – | taguette | taguette |
<= 1.5.0 cpe:2.3:a:taguette:taguette:*:*:*:*:*:*:*:* |
Original advisory text
Taguette vulnerable to password reset link poisoning
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
References
- https://github.com/advisories/GHSA-7rc8-5c8q-jr6j
- https://github.com/pypa/advisory-database/tree/main/vulns/taguette/PYSEC-2025-18...
- https://github.com/remram44/taguette/security/advisories/GHSA-7rc8-5c8q-jr6j Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-62527 Vendor Advisory
- https://gitlab.com/remram44/taguette/-/issues/331 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62527... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-15External Control of System or Configuration Setting
Timeline
Published20 Oct 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta