🚨 CVE-2026-86196
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.
🎖@cveNotify
GitHub
Password reset links in the API plugin are built from the request Host header, allowing anonymous account takeover
### Summary
`POST /api/v1/auth/forgot-password` in the Grav **API plugin** builds the password-reset link in the outgoing email from the `Host` header of the incoming request. An unauthenticated...
September 5, 2026 50
