Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.1, published 12 June 2026.

Which products and versions are affected?

com.appsmith:server (Maven) < 2.0.

Is there a fix for This vulnerability?

A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run com.appsmith:server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Appsmith origin validation bypass in password reset and email verification

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected?

Check whether you run com.appsmith:server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.1 · Published 2026-06-12

Appsmith, a platform for building internal business tools, contains a security flaw in how it generates password reset and email verification links. If the platform is not specifically configured with a fixed base URL, an attacker can trick the system into sending legitimate-looking emails that contain links pointing to a malicious website. If a user clicks these links, the attacker can capture their security tokens and take over their account.

Vendors: Maven.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.1, published 12 June 2026.
Which products and versions are affected?: com.appsmith:server (Maven) < 2.0.
Is there a fix for This vulnerability?: A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run com.appsmith:server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Appsmith's password reset and email verification flows derive the base URL for generated links from the HTTP 'Origin' header. While validation exists, it is only enforced if the 'APPSMITH_BASE_URL' environment variable is explicitly set. If unset, the application defaults to a backward-compatibility mode that accepts any caller-supplied origin. An unauthenticated remote attacker can trigger these flows (via /api/v1/users/forgotPassword or /resendEmailVerification) with a forged Origin header. This results in the delivery of a legitimate email to a victim containing a token-bearing link hosted on an attacker-controlled domain. If the victim clicks the link, the sensitive token is leaked to the attacker. This issue is fixed in version 2.0.

Affected products

Appsmith server < 2.0

Timeline

2026-05-21: disclosed
2026-06-12: advisory
2026-06-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.