CVE-2026-27812

Sub2API (AI API gateway) contains a Password Reset Poisoning flaw in versions before 0.1.85, caused by a Host/Forwarded Header trust issue that lets an attacker inject their own domain into the password reset link and potentially take over an account. The issue is addressed in v0.1.85. If upgradi...