CVE-2026-86196: Authentication Bypass by Spoofing in getgrav grav-plugin-api
Description
A vulnerability in the Grav API plugin (grav-plugin-api) before version 1.0.20 allows unauthenticated attackers to bypass authentication by exploiting the handling of the Host header in the forgot-password endpoint. This flaw enables attackers to craft password reset links that redirect tokens to attacker-controlled domains, potentially leading to account takeover including super-admin accounts.
CVSS v4.0
Score 8.7high
Affected software
getgrav
grav-plugin-api
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Grav API plugin versions prior to 1.0.20 build password reset links using the untrusted Host header in the forgot-password endpoint. An attacker can send password reset requests with a malicious Host header, causing the reset token to be sent to an attacker-controlled domain. This allows interception of the reset token from victim emails and enables the attacker to complete account takeover, including for super-admin accounts. The vulnerability is identified as CVE-2026-86196 with a CVSS 4.0 score of 8.7, indicating high severity.
Potential Impact
Successful exploitation allows unauthenticated attackers to redirect password reset tokens to domains they control, enabling interception of these tokens and full account takeover, including super-admin privileges. This compromises account integrity and potentially the entire Grav installation's security.
Mitigation Recommendations
A fixed version 1.0.20 of the grav-plugin-api is available that addresses this vulnerability. Users should upgrade to version 1.0.20 or later to remediate this issue. No vendor advisory content contradicts this; therefore, upgrading is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T11:52:36.821Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9c0d23acd9273b49d97189
Added to database: 09/05/2026, 12:37:55 UTC
Last enriched: 09/15/2026, 00:56:36 UTC
Last updated: 10/20/2026, 18:48:24 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.