Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url
Impact
The Grav API plugin before 1.0.4 is vulnerable to password reset token poisoning via the admin_base_url field, allowing an unauthenticated attacker to redirect the password reset link to an attacker-controlled server. The weakness is due to insufficient validation of the client-supplied URL. This can lead to full account takeover.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
getgrav · VulnCheck
grav-plugin-api
2 ranges
getgrav · VulnCheck
grav-plugin-api
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 1.0.4
semver versions
unaffected
1.0.4
semver versions
Other versions: unaffected
Original source description
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-61451View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:getgrav:grav-plugin-api:*:*:*:*:*:*:*:*Before: 1.0.4
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:getgrav:grav-plugin-api:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.4"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.