# CVE-2026-100870: Sylius password-reset link Host header injection

Source: https://junglewise.ai/threats/cve-2026-100870-sylius-versions-before-1-12-25-1-13-17-1-14-20-2-1-16-and-2-2-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100870 · Severity: high · CVSS 8.8 · Published 2026-09-27

Sylius, an open-source e-commerce platform, builds administrator password-reset links using untrusted request headers without validation. An attacker can forge requests with malicious Host headers to redirect password-reset tokens to attacker-controlled domains, compromising administrator accounts and gaining full control of the e-commerce system.

Technologies: [Sylius](https://junglewise.ai/threats/technologies/sylius). Vendors: [Sylius](https://junglewise.ai/threats/vendors/sylius).

## Quick answers

**Is CVE-2026-100870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100870 being exploited in the wild.

**How severe is CVE-2026-100870?** High severity, with a CVSS score of 8.8, published 27 September 2026.

**Which products and versions are affected?** Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9.

**Is there a fix for CVE-2026-100870?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100870 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100870?** Check whether you run Sylius at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in password-reset link generation, where the application constructs reset URLs using the HTTP Host header directly without validation. An unauthenticated attacker can request a password reset for a known administrator email address while supplying a forged Host header, causing the reset token to be sent to an attacker-controlled domain. This allows token interception and subsequent account takeover.

## Affected products

- Sylius Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9

## Timeline

- 2026-09-27: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/Sylius/Sylius](https://github.com/Sylius/Sylius)

## Related threats

- [Sylius authorization bypass in product review API](https://junglewise.ai/threats/cve-2026-108724-sylius-through-2-3-0-contains-an-authorization-bypass)
- [Sylius payment amount validation bypass in cart recalculation](https://junglewise.ai/threats/cve-2026-100872-sylius-versions-before-2-1-16-and-2-2-9-fail-to-validate-payment)
- [Sylius JWT token firewall identification bypass](https://junglewise.ai/threats/cve-2026-100871-sylius-versions-before-1-12-25-1-13-17-1-14-20-2-1-16-and-2-2-9)
- [Sylius Shop API payment refund authorization bypass](https://junglewise.ai/threats/cve-2026-100869-sylius-versions-before-2-1-16-and-2-2-9-fail-to-restrict-payment)
- [Sylius IDOR in Shop Payment Request API endpoints](https://junglewise.ai/threats/cve-2026-53639-sylius-idor-in-shop-payment-request-api-endpoints)