Authentication Bypass in Grav API Plugin by GetGrav

CVE-2026-86196

What is CVE-2026-86196?

The Grav API plugin prior to version 1.0.20 contains a vulnerability that allows attackers to exploit untrusted Host headers in the forgot-password endpoint. This flaw may enable unauthorized individuals to generate password reset links directed to malicious sites, leading to potential interception of reset tokens sent to users. Consequently, attackers could gain access to user accounts, including those with administrative privileges, posing a significant security threat to users of the Grav API.

References