# CVE-2026-86196: Grav API Plugin password reset link spoofing via Host header

Source: https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86196 · Severity: info · CVSS 8.7 · Published 2026-09-05

The Grav API plugin's password reset feature trusts the HTTP Host header to build password reset links sent to users' email addresses. An attacker can send a password reset request for any account while spoofing the Host header to point to their own domain, causing the victim to receive a reset link that redirects to the attacker's server. The attacker can then capture the reset token and take over any account, including super-admin accounts that grant full control of the Grav site.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-86196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86196 being exploited in the wild.

**How severe is CVE-2026-86196?** Informational severity, with a CVSS score of 8.7, published 5 September 2026.

**Which products and versions are affected?** Grav API Plugin before 1.0.20.

**Is there a fix for CVE-2026-86196?** A patch was published on 2026: Fixed in Grav API Plugin 1.0.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86196 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86196?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass stemming from improper use of untrusted user input (the HTTP Host header) to construct password reset URLs. In the POST /api/v1/auth/forgot-password endpoint, the Grav API plugin builds the password reset link from $_SERVER['HTTP_HOST'] without validation, and includes a reset token in the URL query string. An unauthenticated attacker can send a forgot-password request with an arbitrary Host header pointing to attacker-controlled infrastructure. The victim receives a legitimate reset email from the legitimate site, but the link in the email points to the attacker's domain and carries a valid, server-side token. When the victim clicks the link, the attacker reads the token from their access logs and completes the reset via POST /api/v1/auth/reset-password, taking over the account. No preconditions (authentication, session, special config) are required; only that the server answers requests for arbitrary Host values (standard Apache/Nginx default behavior). Patched in version 1.0.20.

## Affected products

- Grav API Plugin before 1.0.20

## Timeline

- 2026-08-21: disclosed: GHSA-262p-56vv-7v5r published
- 2026-09-05: disclosed: CVE-2026-86196 published on NVD
- 2026: patched: Fixed in Grav API Plugin 1.0.20

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r](https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r)
- [https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header](https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)
- [Grav API Plugin JWT token exposure in URL query parameter](https://junglewise.ai/threats/cve-2026-63408-grav-api-plugin-jwt-token-exposure-in-url-query-parameter)