What is CVE-2022-22691?

CVE-2022-22691 is a medium-severity vulnerability in Umbraco Cms, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 6.8/10. Published 2022-01-18.

How severe is CVE-2022-22691?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Umbraco Cms

CVE-2022-22691

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.

Published 2022-01-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.010 (61.9th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 61.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000

Affected products

Umbraco Cms — versions unspecified
Umbraco Cms

Weakness classification (CWE)

References

appcheck-ng.com/umbraco-applicationurl-overwrite-persistent-password-reset-pois… (Exploit, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2022-22691?: CVE-2022-22691 is a medium-severity vulnerability in Umbraco Cms, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 6.8/10. Published 2022-01-18.
How severe is CVE-2022-22691?: Medium severity. CVSS v3 base score is 6.8 out of 10.