EUVD-2026-44648
GHSA-r9r9-wg76-6qmq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network request (AV:N/PR:N) but the victim must click the poisoned reset link (UI:R); token disclosure plus account takeover give C:H/I:H, with no direct availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
AnalysisAI
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
Technical ContextAI
Grav is a PHP-based flat-file CMS; the affected component is its optional REST API plugin (grav-plugin-api), which exposes authentication endpoints including forgot-password. The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect) applied to email link generation: the sanitizeHttpUrl() helper validates only that the client-supplied admin_base_url uses an http/https scheme and never checks the host against the server's own origin. Consequently the base URL used to construct the password-reset link is fully attacker-influenced, either via the JSON body field or the Referer/Origin request headers. This turns a classic open-redirect weakness into a token-disclosure primitive, since the sensitive reset token is appended to a host the attacker controls.
RemediationAI
Upgrade the Grav API plugin to version 1.0.4 or later, which is the vendor-released patch that addresses the origin-validation flaw (see GHSA-5xc4-j99p-cp4m). If immediate patching is not possible, apply compensating controls to the /api/v1/auth/forgot-password endpoint: reject or ignore the client-supplied admin_base_url field and force the reset link's base URL to a server-side configured canonical origin; strip or do not trust the Referer and Origin headers when building the reset URL; and restrict the reset link host to an allowlist of the server's own domain(s). At the network edge, a WAF rule can drop forgot-password requests whose admin_base_url or Origin/Referer host differs from the site's known hostname - note this may cause false positives for legitimate multi-domain deployments. Do not rely on disabling the endpoint entirely unless password reset is handled elsewhere, as that removes account-recovery functionality. Full advisory context is at https://www.vulncheck.com/advisories/grav-before-password-reset-token-poisoning-via-admin-base-url.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today