Sylius generates password‑reset URLs by using the Host header from the incoming request without sanitization. An attacker can craft a request with a forged Host header, trigger a reset for a known administrator email, and receive a reset link that points to a domain controlled by the attacker. This allows the attacker to capture the token and create a new administrator session, effectively taking over an administrative account. The vulnerability can be exploited by unauthenticated users and results in complete loss of confidentiality and integrity of the administrative privileges.

The flaw affects Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9. Any deployment of these releases is vulnerable regardless of hosting environment, as the Host header handling is coded directly in the application.

The CVSS score is 8.7, which reflects substantial impact and ease of exploitation. No EPSS data is available, but the lack of validation means the attack can be performed with simple HTTP requests. The vulnerability is not listed in the CISA KEV catalog, but its high severity and straightforward attack path make it a priority for patching.