Appsmith v1.93 and later introduced proper validation when constructing email reset and verification links. Prior to that, the platform accepted the Origin header from incoming HTTP requests and used it as the base URL for authentication emails. An attacker who can set a malicious Origin header in a request can cause the system to generate password reset or verification links that point to a domain under the attacker’s control. When a user clicks such a link, the attacker receives sensitive authentication tokens embedded in the link, allowing the attacker to hijack the account. This flaw directly impacts authentication and confidentiality of user accounts, classified as CWE‑346.

Appsmith (appsmithorg:appsmith) is affected for all releases before version 1.93. The vulnerability exists in the server component that sends email links; any deployment of Appsmith before the 1.93 patch is vulnerable.

The CVSS score of 9.7 denotes a critical severity. EPSS is reported as < 1 %, indicating a low probability of current exploitation under normal circumstances, and the vulnerability is not listed in the CISA KEV catalog. The exploitation route requires an attacker to control an HTTP request to the server to provide a forged Origin header, which is feasible for remote adversaries with internet access to the Appsmith instance. Once the link is delivered via email, the attacker can immediately compromise the affected account.