The Grav API plugin (grav-plugin-api) prior to version 1.0.4 does not adequately validate the admin_base_url parameter in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http or https but does not verify that the host matches the server's origin. This allows an attacker to supply a URL pointing to an attacker-controlled domain. Consequently, password reset emails sent to victims contain reset links that redirect to attacker-controlled sites, exposing valid reset tokens. This vulnerability can be triggered by unauthenticated attackers and can also be influenced by Referer or Origin HTTP headers.

An unauthenticated attacker can exploit this vulnerability to cause password reset emails to contain links to attacker-controlled domains. When victims follow these links, their valid password reset tokens are disclosed to the attacker, enabling full account takeover. This represents a critical security risk affecting user account integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Avoid using vulnerable versions of the Grav API plugin and consider restricting or validating the admin_base_url parameter at the application or network level if possible.