PT-2026-86421
CVE-2026-86196
·
تاريخ النشر
2026-09-05
·
تاريخ التحديث
2026-09-05
الوصف من
CVSS 4.0
8.7
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Grav API plugin versions prior to 1.0.20
Description
Unauthenticated attackers can redirect password reset tokens to domains under their control by manipulating the
Host header in the 'forgot-password' endpoint. By sending reset requests for any account using a malicious header, an attacker can intercept the reset token from the victim's email and achieve full account takeover, including super-admin accounts.Recommendations
Update Grav API plugin to version 1.0.20 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾