Executive brief
A vulnerability in the Grav API plugin allows attackers to hijack user accounts, including administrators. By sending a specially crafted request to the password reset system, an attacker can force the site to send a legitimate-looking reset email that actually contains a link to the attacker's server. If a user clicks this link, the attacker captures their secret reset token and can immediately change the user's password to take over the account.
Technical details
The Grav API plugin fails to validate the origin of the 'admin_base_url' field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only verifies that the URL scheme is http or https but does not check the host against the server's own origin. An unauthenticated attacker can supply an arbitrary host via the request body, Referer header, or Origin header. When a victim receives and clicks the resulting poisoned password reset link, their valid reset token is transmitted to the attacker-controlled server. This token can then be used to reset the victim's password and gain full access to the account. This issue also affects the InvitationsController. The vulnerability is patched in version 1.0.4.
Affected products
- getgrav Grav API plugin (grav-plugin-api) < 1.0.4
Timeline
- 2026-06-25: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: CVE published and NVD record created