ETK-2026-4322Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4322",
  "cve_id": null,
  "display_id": "ETK-2026-4322",
  "ghsa_id": "GHSA-qmwm-25jf-8mpw",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Trusted-proxy host header injection in bref/laravel-bridge",
  "summary": "bref/laravel-bridge versions before 3.1.7 trust all proxy addresses by default, allowing client-supplied forwarded host and prefix values to affect Laravel-generated URLs. An unauthenticated attacker may cause password-reset links to use an attacker-controlled host when the application does not enforce an expected URL root or trusted host policy.",
  "mitigation": "Upgrade bref/laravel-bridge to version 3.1.7 or later. Also configure Laravel to enforce the expected URL root or restrict trusted hosts, and avoid exposing direct origins where forwarded headers are not sanitized.",
  "vendor": "composer",
  "product": "composer:bref/laravel-bridge",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, <= 3.1.6"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "3.1.7"
      ],
      "package_name": "bref/laravel-bridge",
      "purl": "pkg:composer/bref/laravel-bridge"
    }
  ],
  "cwes": [
    348
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.6727422,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T13:24:54+00:00",
      "days": -0.4597343854398148,
      "is_lower_bound": true,
      "measured_at": "2026-11-13T00:26:55.540559+00:00",
      "url": "https://github.com/brefphp/laravel-bridge/security/advisories/GHSA-qmwm-25jf-8mpw"
    }
  }
}