Is CVE-2026-61451 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61451 being exploited in the wild.

How severe is CVE-2026-61451?

Critical severity, with a CVSS score of 9.6, published 15 July 2026.

Is there a fix for CVE-2026-61451?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61451 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61451?

Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61451: Grav API plugin password reset token poisoning

CVE-2026-61451 · Severity: critical · CVSS 9.6 · Published 2026-07-15

A vulnerability in the Grav API plugin allows attackers to hijack user accounts, including administrators. By sending a specially crafted request to the password reset system, an attacker can force the site to send a legitimate-looking reset email that actually contains a link to the attacker's server. If a user clicks this link, the attacker captures their secret reset token and can immediately change the user's password to take over the account.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-61451 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61451 being exploited in the wild.
How severe is CVE-2026-61451?: Critical severity, with a CVSS score of 9.6, published 15 July 2026.
Which products and versions are affected?: Grav API Plugin < 1.0.4.
Is there a fix for CVE-2026-61451?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61451 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61451?: Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Grav API plugin fails to validate the origin of the 'admin_base_url' field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only verifies that the URL scheme is http or https but does not check the host against the server's own origin. An unauthenticated attacker can supply an arbitrary host via the request body, Referer header, or Origin header. When a victim receives and clicks the resulting poisoned password reset link, their valid reset token is transmitted to the attacker-controlled server. This token can then be used to reset the victim's password and gain full access to the account. This issue also affects the InvitationsController. The vulnerability is patched in version 1.0.4.

Affected products

getgrav Grav API plugin (grav-plugin-api) < 1.0.4

Timeline

2026-06-25: advisory: Vendor advisory published on GitHub
2026-07-15: disclosed: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.