Vulnerability in Getgrav Grav-Plugin-Api

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

Published 2026-09-05 · last modified 2026-09-08.

EPSS exploit prediction

EPSS: 0.004 (36.5th percentile), scored 2026-10-21.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.002

Affected products

Getgrav Grav-Plugin-Api

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

github.com/getgrav/grav/security/advisories/GHSA-262p-56vv-7v5r (vendor-advisory)
www.vulncheck.com/advisories/grav-api-plugin-before-1.0.20-authentication-bypas… (third-party-advisory)