Is CVE-2026-86196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86196 being exploited in the wild.

How severe is CVE-2026-86196?

Informational severity, with a CVSS score of 8.7, published 5 September 2026.

Is there a fix for CVE-2026-86196?

A patch was published on 2026: Fixed in Grav API Plugin 1.0.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86196 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86196?

Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86196: Grav API Plugin password reset link spoofing via Host header

CVE-2026-86196 · Severity: info · CVSS 8.7 · Published 2026-09-05

The Grav API plugin's password reset feature trusts the HTTP Host header to build password reset links sent to users' email addresses. An attacker can send a password reset request for any account while spoofing the Host header to point to their own domain, causing the victim to receive a reset link that redirects to the attacker's server. The attacker can then capture the reset token and take over any account, including super-admin accounts that grant full control of the Grav site.

Technologies: Grav API Plugin. Vendors: Grav.

Quick answers

Is CVE-2026-86196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86196 being exploited in the wild.
How severe is CVE-2026-86196?: Informational severity, with a CVSS score of 8.7, published 5 September 2026.
Which products and versions are affected?: Grav API Plugin before 1.0.20.
Is there a fix for CVE-2026-86196?: A patch was published on 2026: Fixed in Grav API Plugin 1.0.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86196 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86196?: Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass stemming from improper use of untrusted user input (the HTTP Host header) to construct password reset URLs. In the POST /api/v1/auth/forgot-password endpoint, the Grav API plugin builds the password reset link from $_SERVER['HTTP_HOST'] without validation, and includes a reset token in the URL query string. An unauthenticated attacker can send a forgot-password request with an arbitrary Host header pointing to attacker-controlled infrastructure. The victim receives a legitimate reset email from the legitimate site, but the link in the email points to the attacker's domain and carries a valid, server-side token. When the victim clicks the link, the attacker reads the token from their access logs and completes the reset via POST /api/v1/auth/reset-password, taking over the account. No preconditions (authentication, session, special config) are required; only that the server answers requests for arbitrary Host values (standard Apache/Nginx default behavior). Patched in version 1.0.20.

Affected products

Grav API Plugin before 1.0.20

Timeline

2026-08-21: disclosed: GHSA-262p-56vv-7v5r published
2026-09-05: disclosed: CVE-2026-86196 published on NVD
2026: patched: Fixed in Grav API Plugin 1.0.20

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.