CVE-2026-86196

Grav API Plugin versions before 1.0.20 are vulnerable to an authentication bypass via the Host header in the forgot-password endpoint. The plugin builds password reset links from this untrusted header, allowing an unauthenticated attacker to redirect reset tokens to attacker-controlled domains, l...