high8.7
CVE-2026-86196
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated atta…
Impact
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.
Affected products
| Product | Affected versions |
|---|---|
| Grav API Plugin | before 1.0.20 |
Versions were read from the advisory text. No structured product data has been published for this record yet.