CVE-2026-86196: Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.20 - Compensating control
Until upgraded, restrict network access to the Grav forgot-password endpoint to trusted clients/IPs to reduce exposure to unauthenticated password reset link manipulation via Host header.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Grav API Plugin versions before 1.0.20 are affected. The issue is in the forgot-password endpoint's handling of the Host header.
What does an attacker need to exploit this?
An attacker does not need to authenticate. They need to submit a password-reset request for a target account while supplying a malicious Host header, then receive the reset token through an attacker-controlled domain.
What is the likely impact if exploitation succeeds?
The attacker can complete a password reset for the targeted account and take it over. This includes super-admin accounts.
How can I determine whether my instance is vulnerable?
Check the installed Grav API Plugin version. Versions earlier than 1.0.20 are affected.