The Grav API plugin (grav-plugin-api) prior to version 1.0.4 does not validate the origin of the client-supplied admin_base_url parameter in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http or https but does not verify that the host matches the server's own origin. Consequently, an unauthenticated attacker can supply an arbitrary host, causing the password reset email to contain a reset link pointing to an attacker-controlled server. When a victim follows this link, the valid reset token is exposed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin HTTP headers.

An unauthenticated attacker can exploit this vulnerability to cause password reset emails to include links to attacker-controlled domains. This leads to disclosure of valid password reset tokens to the attacker, enabling full account takeover of victim accounts. The vulnerability affects confidentiality and integrity of user accounts and poses a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of the Grav API plugin. Monitor vendor communications for updates and apply patches promptly once released. Consider implementing additional validation or filtering of URLs in the password reset workflow as a temporary mitigation.