CVE-2026-94380 PUBLISHED

Host Header Injection in HAVELSAN's Liman MYS

Assigner: TR-CERT
Reserved: 21.09.2026 Published: 26.10.2026 Updated: 26.10.2026

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 8.1

Product Status

Vendor HAVELSAN Inc.
Product Liman MYS
Versions Default: unaffected
  • affected from 2.3.4-1124 to 2.3.5-1131 (excl.)

Credits

  • Eren Can ÖZMEN finder

References

Problem Types

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password CWE

Impacts

  • CAPEC-50 Password Recovery Exploitation