CVE-2026-61451: Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.4 - Configuration
Modify the endpoint to validate the origin of the client-supplied admin_base_url (and any influence via Referer/Origin headers) so the reset link cannot be generated with an attacker-controlled host.
Grav API plugin (grav-plugin-api) - POST /api/v1/auth/forgot-password admin_base_url origin validation = Validate that admin_base_url is from the server's own origin (scheme http/https AND host matches server origin) instead of only checking sanitizeHttpUrl() scheme
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61451?
CVE-2026-61451 has a critical severity rating of 9.4.
What is the risk associated with CVE-2026-61451?
CVE-2026-61451 poses a risk level of 80, indicating it is highly critical.
How can I fix CVE-2026-61451?
To fix CVE-2026-61451, upgrade the grav-plugin-api to version 1.0.4 or later.
What is the main issue described in CVE-2026-61451?
CVE-2026-61451 involves password reset token poisoning due to insufficient validation of the client-supplied admin_base_url.
Which version of Grav is affected by CVE-2026-61451?
Grav versions before 1.0.4 are affected by CVE-2026-61451.