CVE-2026-86196: Grav API Plugin Auth Bypass Vulnerability

CVE-2026-86196 Overview

CVE-2026-86196 is a host header injection vulnerability in the Grav API plugin affecting versions before 1.0.20. The forgot-password endpoint constructs password reset links using the untrusted HTTP Host header without validation. Unauthenticated attackers can submit password reset requests for any account while supplying a malicious Host header. When victims click the resulting link in their email, the reset token is transmitted to an attacker-controlled domain. This exposes reset tokens for arbitrary accounts, including super-administrator accounts, enabling full account takeover. The weakness is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated attackers can hijack password reset tokens for any Grav account, including super-admin, by injecting a malicious Host header into forgot-password requests.

Affected Products

Grav API plugin versions prior to 1.0.20
Grav CMS installations with the API plugin enabled
Deployments exposing the forgot-password endpoint to untrusted networks

Discovery Timeline

2026-09-05 - CVE-2026-86196 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86196

Vulnerability Analysis

The Grav API plugin generates password reset URLs by reading the Host header from the incoming HTTP request. Web servers commonly forward this header verbatim to the application, and the plugin does not validate it against an allowlist of trusted hostnames. An attacker sends a POST request to the forgot-password endpoint containing a legitimate victim username or email while replacing the Host header with a domain they control.

The application generates a valid password reset token bound to the victim account and embeds it inside a URL built with the attacker's hostname. Grav delivers this link by email to the victim's registered address. If the victim clicks the link, their browser transmits the reset token to the attacker's server. The attacker then replays the token against the legitimate Grav instance and sets a new password on the victim's account.

Root Cause

The root cause is reliance on client-controlled input for generating security-sensitive URLs. The forgot-password handler trusts the Host header to construct the reset link base rather than using a server-configured canonical hostname. This design fails the trust-boundary check outlined in CWE-290, because request-scoped headers are treated as authoritative identity for the application origin.

Attack Vector

Exploitation requires network access to the forgot-password endpoint and a valid target account identifier. The attacker sends an unauthenticated HTTP request with a spoofed Host header pointing to an attacker-owned domain. The victim must click the emailed reset link for the token to leak, so user interaction is required. Once the token reaches the attacker's server logs, the attacker completes password reset on the real Grav instance. Refer to the GitHub Security Advisory GHSA-262p-56vv-7v5r and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-86196

Indicators of Compromise

Web server or reverse-proxy logs showing POST requests to the Grav forgot-password endpoint with Host headers that do not match the configured server hostname.
Outbound DNS or HTTP requests from user endpoints to unfamiliar domains resembling Grav login URLs.
Unexpected password change events on administrator or super-admin accounts without a corresponding help-desk ticket.

Detection Strategies

Alert on any HTTP request to /forgot-password or equivalent Grav API routes where the Host header value is not in an approved allowlist.
Correlate password reset email dispatches with subsequent successful password changes from new IP addresses or user-agents.
Review email gateway logs for outbound reset messages containing links to non-canonical domains.

Monitoring Recommendations

Ingest reverse-proxy, web server, and application logs into a centralized analytics platform and normalize the Host header field for continuous inspection.
Track baseline volumes of forgot-password requests and alert on spikes targeting privileged accounts.
Enable audit logging for administrative account changes in Grav and forward events to the SOC.

How to Mitigate CVE-2026-86196

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.20 or later on all instances.
Rotate credentials for all administrator and super-admin accounts and invalidate any pending password reset tokens.
Restrict access to the forgot-password endpoint to trusted networks where operationally feasible.
Audit recent password reset activity for unexplained resets targeting privileged users.

Patch Information

The Grav maintainers released a fix in the API plugin version 1.0.20. The patch stops using the request Host header when constructing password reset URLs and relies on a server-configured canonical hostname instead. Full details are available in the GitHub Security Advisory GHSA-262p-56vv-7v5r.

Workarounds

Configure the upstream web server or reverse proxy to reject or normalize requests whose Host header does not match the canonical site hostname.
Set an explicit base_url or equivalent canonical URL in Grav configuration so downstream code has a trusted source of the hostname.
Temporarily disable the forgot-password functionality until patching is complete, forcing password resets through an out-of-band administrative workflow.

bash

# Example nginx configuration enforcing an allowed Host header
server {
    listen 443 ssl;
    server_name grav.example.com;

    if ($host != "grav.example.com") {
        return 421;
    }

    location / {
        proxy_set_header Host grav.example.com;
        proxy_pass http://grav_backend;
    }
}