{"id":"CVE-2026-86196","title":"Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains","summary":"Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can s…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-290"],"vendor":"getgrav","product":"grav-plugin-api","affected":["grav-plugin-api < 1.0.20"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:05:53.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86196","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypass-via-host-header","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T17:17:48.067441Z"},"cvssSource":"cna","epss":0.00257,"epssPercentile":0.17639,"ingestedAt":"2026-09-06T09:53:13.675Z","slug":"CVE-2026-86196","body":"## Overview\n\nGrav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":8326,"id":"CVE-2026-86196","ts":1788919998290,"field":"exploit_available","old":"false","new":"true"},{"seq":8325,"id":"CVE-2026-86196","ts":1788919998290,"field":"cvss","old":null,"new":"8.7"},{"seq":8324,"id":"CVE-2026-86196","ts":1788919998290,"field":"severity","old":"none","new":"high"},{"seq":8135,"id":"CVE-2026-86196","ts":1788919288252,"field":"exploit_available","old":"true","new":"false"},{"seq":8134,"id":"CVE-2026-86196","ts":1788919288252,"field":"cvss","old":"8.7","new":null},{"seq":8133,"id":"CVE-2026-86196","ts":1788919288252,"field":"severity","old":"high","new":"none"},{"seq":7944,"id":"CVE-2026-86196","ts":1788916360398,"field":"exploit_available","old":"false","new":"true"},{"seq":7943,"id":"CVE-2026-86196","ts":1788916360398,"field":"cvss","old":null,"new":"8.7"},{"seq":7942,"id":"CVE-2026-86196","ts":1788916360398,"field":"severity","old":"none","new":"high"},{"seq":7753,"id":"CVE-2026-86196","ts":1788915305805,"field":"exploit_available","old":"true","new":"false"},{"seq":7752,"id":"CVE-2026-86196","ts":1788915305805,"field":"cvss","old":"8.7","new":null},{"seq":7751,"id":"CVE-2026-86196","ts":1788915305805,"field":"severity","old":"high","new":"none"},{"seq":7562,"id":"CVE-2026-86196","ts":1788912719153,"field":"exploit_available","old":"false","new":"true"},{"seq":7561,"id":"CVE-2026-86196","ts":1788912719153,"field":"cvss","old":null,"new":"8.7"},{"seq":7560,"id":"CVE-2026-86196","ts":1788912719153,"field":"severity","old":"none","new":"high"},{"seq":7371,"id":"CVE-2026-86196","ts":1788911338221,"field":"exploit_available","old":"true","new":"false"},{"seq":7370,"id":"CVE-2026-86196","ts":1788911338221,"field":"cvss","old":"8.7","new":null},{"seq":7369,"id":"CVE-2026-86196","ts":1788911338221,"field":"severity","old":"high","new":"none"},{"seq":7175,"id":"CVE-2026-86196","ts":1788909080704,"field":"exploit_available","old":"false","new":"true"},{"seq":7174,"id":"CVE-2026-86196","ts":1788909080704,"field":"cvss","old":null,"new":"8.7"},{"seq":7173,"id":"CVE-2026-86196","ts":1788909080704,"field":"severity","old":"none","new":"high"},{"seq":6987,"id":"CVE-2026-86196","ts":1788907394923,"field":"exploit_available","old":"true","new":"false"},{"seq":6986,"id":"CVE-2026-86196","ts":1788907394923,"field":"cvss","old":"8.7","new":null},{"seq":6985,"id":"CVE-2026-86196","ts":1788907394923,"field":"severity","old":"high","new":"none"},{"seq":6789,"id":"CVE-2026-86196","ts":1788905446512,"field":"exploit_available","old":"false","new":"true"},{"seq":6788,"id":"CVE-2026-86196","ts":1788905446512,"field":"cvss","old":null,"new":"8.7"},{"seq":6787,"id":"CVE-2026-86196","ts":1788905446512,"field":"severity","old":"none","new":"high"},{"seq":6607,"id":"CVE-2026-86196","ts":1788903461652,"field":"exploit_available","old":"true","new":"false"},{"seq":6606,"id":"CVE-2026-86196","ts":1788903461652,"field":"cvss","old":"8.7","new":null},{"seq":6605,"id":"CVE-2026-86196","ts":1788903461652,"field":"severity","old":"high","new":"none"},{"seq":6393,"id":"CVE-2026-86196","ts":1788901812501,"field":"exploit_available","old":"false","new":"true"},{"seq":6392,"id":"CVE-2026-86196","ts":1788901812501,"field":"cvss","old":null,"new":"8.7"},{"seq":6391,"id":"CVE-2026-86196","ts":1788901812501,"field":"severity","old":"none","new":"high"},{"seq":6223,"id":"CVE-2026-86196","ts":1788899562974,"field":"exploit_available","old":"true","new":"false"},{"seq":6222,"id":"CVE-2026-86196","ts":1788899562974,"field":"cvss","old":"8.7","new":null},{"seq":6221,"id":"CVE-2026-86196","ts":1788899562974,"field":"severity","old":"high","new":"none"},{"seq":5986,"id":"CVE-2026-86196","ts":1788898181358,"field":"exploit_available","old":"false","new":"true"},{"seq":5985,"id":"CVE-2026-86196","ts":1788898181358,"field":"cvss","old":null,"new":"8.7"},{"seq":5984,"id":"CVE-2026-86196","ts":1788898181358,"field":"severity","old":"none","new":"high"},{"seq":5875,"id":"CVE-2026-86196","ts":1788895711961,"field":"exploit_available","old":"true","new":"false"},{"seq":5874,"id":"CVE-2026-86196","ts":1788895711961,"field":"cvss","old":"8.7","new":null},{"seq":5873,"id":"CVE-2026-86196","ts":1788895711961,"field":"severity","old":"high","new":"none"},{"seq":5697,"id":"CVE-2026-86196","ts":1788894534833,"field":"exploit_available","old":"false","new":"true"},{"seq":5696,"id":"CVE-2026-86196","ts":1788894534833,"field":"cvss","old":null,"new":"8.7"},{"seq":5695,"id":"CVE-2026-86196","ts":1788894534833,"field":"severity","old":"none","new":"high"},{"seq":5655,"id":"CVE-2026-86196","ts":1788891871764,"field":"exploit_available","old":"true","new":"false"},{"seq":5654,"id":"CVE-2026-86196","ts":1788891871764,"field":"cvss","old":"8.7","new":null},{"seq":5653,"id":"CVE-2026-86196","ts":1788891871764,"field":"severity","old":"high","new":"none"},{"seq":5619,"id":"CVE-2026-86196","ts":1788890895896,"field":"exploit_available","old":"false","new":"true"},{"seq":5618,"id":"CVE-2026-86196","ts":1788890895896,"field":"cvss","old":null,"new":"8.7"}]}