CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.20 is vulnerable due to its reliance on the untrusted Host header in the password reset process, enabling unauthenticated attackers to manipulate reset token links. This flaw allows attackers to redirect tokens to their own domains, facilitating account takeovers, including access to super-admin accounts. Organizations using this plugin should prioritize immediate updates to mitigate the risk of unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.