---
id: CVE-2026-94380
title: Host Header Injection in HAVELSAN's Liman MYS
summary: >-
  Weak Password Recovery Mechanism for Forgotten Password vulnerability in
  HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.


  This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-640
vendor: HAVELSAN Inc.
product: Liman MYS
affected:
  - liman_mys >= 2.3.4-1124 < 2.3.5-1131
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-26T13:32:00.644282Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:35:18.248Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94380'
references:
  - url: 'https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1396'
tags:
  - cve.org
ingestedAt: '2026-10-26T12:26:18.480Z'
---

## Overview

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

## Affected

- `liman_mys >= 2.3.4-1124 < 2.3.5-1131`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.