CVE-2026-100870: Sylius Auth Bypass Vulnerability

CVE-2026-100870 Overview

CVE-2026-100870 is a Host header injection vulnerability in Sylius, an open-source e-commerce platform built on Symfony. Affected versions construct administrator password-reset links using the unvalidated HTTP Host header from inbound requests. An unauthenticated attacker who knows an administrator email address can submit a password-reset request with a forged Host header. The resulting reset link points to an attacker-controlled domain. If the administrator clicks the link, the reset token leaks to the attacker, enabling full account takeover. The weakness is tracked as CWE-640: Weak Password Recovery Mechanism.

Critical Impact

Successful exploitation leaks valid admin password-reset tokens to attacker-controlled hosts, enabling takeover of Sylius administrator accounts.

Affected Products

• Sylius versions prior to 1.12.25
• Sylius versions prior to 1.13.17, 1.14.20
• Sylius versions prior to 2.1.16 and 2.2.9

Discovery Timeline

• 2026-09-27 - CVE-2026-100870 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100870

Vulnerability Analysis

Sylius generates the administrator password-reset URL inside ResetPasswordEmailManager. In vulnerable releases, the URL is built from the current request context, which Symfony populates from the inbound HTTP Host header. The service never validates that header against an allowlist of trusted hosts or against a configured canonical channel URL.

An unauthenticated attacker submits POST /admin/forgotten-password for a known administrator email address while setting Host: attacker.example. The mailer renders a reset link such as https://attacker.example/admin/reset-password/<token>. When the administrator opens the link, the token is transmitted to the attacker's server as part of the request path. The attacker replays the token against the legitimate Sylius host to reset the password.

Root Cause

The mailer resolved the base URL from the incoming request rather than from server-side configuration. No channel context or unsecured_urls setting was consulted, so any Host value accepted by the upstream web server propagated directly into outgoing email content.

Attack Vector

The attack is network-based, requires no authentication, and requires one user interaction (the administrator clicking the poisoned link). Attackers need only a reachable Sylius admin forgotten-password endpoint and knowledge or guess of a valid administrator email address.

// Patch excerpt: src/Sylius/Bundle/CoreBundle/Mailer/ResetPasswordEmailManager.php
namespace Sylius\Bundle\CoreBundle\Mailer;

use Sylius\Component\Channel\Context\ChannelContextInterface;
use Sylius\Component\Channel\Context\ChannelNotFoundException;
use Sylius\Component\Channel\Model\ChannelInterface;
use Sylius\Component\Mailer\Sender\SenderInterface;
use Sylius\Component\User\Model\UserInterface;
use Symfony\Component\Routing\Exception\RouteNotFoundException;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Routing\RouterInterface;

final class ResetPasswordEmailManager implements ResetPasswordEmailManagerInterface
{
    public function __construct(
        private SenderInterface $emailSender,
        private RouterInterface $router,
        private ChannelContextInterface $channelContext,
        private bool $unsecuredUrls = false,
    ) {
    }

    public function sendAdminResetPasswordEmail(UserInterface $user, string $localCode): void

The patch injects the Symfony RouterInterface, the Sylius ChannelContextInterface, and a sylius.unsecured_urls flag so the reset URL is generated from the configured channel hostname and scheme rather than the request Host header. Source: Sylius Commit 1255d75.

Detection Methods for CVE-2026-100870

Indicators of Compromise

• Outbound password-reset emails containing links whose hostname does not match the configured Sylius channel URL.
• Web server access logs showing POST requests to /admin/forgotten-password where the Host header differs from the production domain.
• DNS or proxy logs showing administrator browsers resolving unexpected hostnames shortly after a password-reset email is sent.

Detection Strategies

• Review mail transfer agent logs for reset emails and compare embedded URLs against an allowlist of approved admin hostnames.
• Enable application-level logging of the resolved RequestContext host for every password-reset email generation.
• Alert on any inbound request to the forgotten-password endpoint whose Host header is not in the trusted set, including bare IP addresses.

Monitoring Recommendations

• Instrument reverse proxies (Nginx, HAProxy, Traefik) to drop or normalize unexpected Host headers before they reach PHP-FPM.
• Forward web, application, and mail logs to a centralized analytics platform and correlate password-reset requests with subsequent administrator login activity from new IPs.
• Track admin account privilege changes and password resets as high-value events, especially outside business hours.

How to Mitigate CVE-2026-100870

Immediate Actions Required

• Upgrade to Sylius 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9 or later depending on the branch in use.
• Rotate credentials for all administrator accounts and invalidate any outstanding password-reset tokens after upgrading.
• Audit recent password-reset events in logs and confirm that no admin accounts were taken over.

Patch Information

The fix is published in Sylius Release v2.2.9 and in the corresponding 1.12.x, 1.13.x, 1.14.x, and 2.1.x maintenance releases. Technical details are documented in GitHub Security Advisory GHSA-77w3-2367-7xvq and Sylius Pull Request #19215. Additional analysis is available in the VulnCheck Security Advisory for Sylius.

Workarounds

• Configure the upstream web server or load balancer to accept only a strict allowlist of Host header values and reject all others with HTTP 400.
• Set Symfony's trusted_hosts parameter to the production hostname(s) so Symfony rejects requests with unexpected Host values.
• Restrict access to /admin/forgotten-password to known office or VPN IP ranges until the upgrade is deployed.

# Nginx example: enforce canonical admin hostname before PHP processes the request
server {
    listen 443 ssl;
    server_name admin.example.com;

    if ($host != "admin.example.com") {
        return 400;
    }

    location / {
        fastcgi_pass unix:/var/run/php-fpm.sock;
        include fastcgi_params;
    }
}