Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains

Exploitation

poc

Automatable

no

Technical impact

total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.3%

3. Sep 8, 2026Record revised

   Last analysed / modified upstream

4. Sep 9, 2026CVSS changed

   8.7 → —

5. Sep 9, 2026Severity changed

   high → none

6. Sep 9, 2026Public exploit observed

   Exploit / PoC code exists

7. Sep 9, 2026CVSS changed

   — → 8.7

8. Sep 9, 2026Severity changed

   none → high

9. Sep 9, 2026CVSS changed

   8.7 → —

10. Sep 9, 2026Severity changed

    high → none

11. Sep 9, 2026CVSS changed

    — → 8.7

12. Sep 9, 2026Severity changed

    none → high

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026Public exploit / PoC published
• Sep 9, 2026CVSS — → 8.7
• Sep 9, 2026Severity none → high
• Sep 9, 2026Public exploit flag cleared
• Sep 9, 2026CVSS 8.7 → —
• Sep 9, 2026Severity high → none
• Sep 9, 2026Public exploit / PoC published
• Sep 9, 2026CVSS — → 8.7
• Sep 9, 2026Severity none → high
• Sep 9, 2026Public exploit flag cleared
• Sep 9, 2026CVSS 8.7 → —
• Sep 9, 2026Severity high → none