CVE-2026-61451
Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url
- State
- Published
- Severity
- 9.4 Critical
- Published
- Jul 15, 2026
- Updated
- Oct 29, 2026
- Reserved
- Jul 9, 2026
Description
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
| 3.1 | 9.6 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
grav-plugin-apigetgrav |
|
References
- GitHub Security Advisory (GHSA-5xc4-j99p-cp4m)vendor-advisory
- VulnCheck Advisory: Grav before 1.0.4 Password Reset Token Poisoning via admin_base_urlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.