Password Reset Vulnerability in Sylius by Sylius

CVE-2026-100870

What is CVE-2026-100870?

Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to a Host header injection flaw in the password reset process. This vulnerability allows unauthenticated attackers to manipulate the Host header and redirect password reset tokens to malicious domains. By exploiting this flaw, attackers can request password resets for known administrator email addresses, intercepting valid tokens and potentially gaining unauthorized access to administrator accounts. It is crucial for users of affected versions to apply security patches and review security measures to mitigate risks.

References