CVE-2026-86196

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.20

Description Unauthenticated attackers can redirect password reset tokens to domains under their control by manipulating the Host header in the 'forgot-password' endpoint. By sending reset requests for any account using a malicious header, an attacker can intercept the reset token from the victim's email and achieve full account takeover, including super-admin accounts.

Recommendations Update Grav API plugin to version 1.0.20 or later.