CVE-2026-61451

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.4

Description An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the sanitizeHttpUrl() function fails to verify the host against the server's own origin, checking only that the URL scheme is http or https. The issue exists in the 'POST /api/v1/auth/forgot-password' endpoint via the admin base url field, and can also be influenced by the Referer or Origin headers. If a victim follows the malicious link, the valid reset token is disclosed to the attacker, allowing for full account takeover.

Recommendations Update to version 1.0.4 or later.