A critical authentication bypass vulnerability in the Grav API plugin enables unauthenticated attackers to hijack user accounts, including super-admin profiles, via malicious Host header manipulation.

This flaw exists in the forgot-password endpoint, which incorrectly utilizes the untrusted Host header to construct password reset links. This allows an unauthenticated attacker to redirect these tokens to an attacker-controlled domain and intercept them to gain unauthorized access.

The ability for an unauthenticated attacker to perform account takeover, including administrative accounts, poses a severe risk to the confidentiality, integrity, and availability of the entire Grav installation. With a CVSS score of 8.7, this high-severity vulnerability could lead to total system compromise, unauthorized data exfiltration, and significant reputational damage.

Immediate Action: Update the Grav API plugin to version 1.0.20 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application access logs for unusual HTTP Host header values and monitor for suspicious password reset requests originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to validate or sanitize the Host header against a whitelist of expected domains to mitigate potential exploitation attempts.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the potential for full administrative account takeover, organizations using the Grav API plugin must prioritize updating to version 1.0.20. Failure to patch allows attackers to bypass security controls entirely, making immediate remediation essential to maintaining the security posture of the application.