CVE-2026-86196 — Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect …
Published: 2026-09-05 · CVSS: 8.7 · CVSS 4.0
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7