The Grav API plugin builds password‑reset URLs using the value of the Host header, which is provided by the client. An attacker can supply any Host value in the forgot‑password endpoint, causing a reset link that points to an attacker‑controlled domain to be generated and emailed to the target user. Because the reset link can be captured from the victim’s email, the attacker can redeem the token and set a new password, effectively taking over the account, including super‑admin accounts. The weakness is an authentication bypass that compromises confidentiality, integrity, and availability of user accounts.

Versions of the Grav API plugin from getgrav (grav plugin) earlier than 1.0.20 are affected. The vulnerability applies to all deployments that install the plugin with these pre‑1.0.20 releases.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only send an unauthenticated HTTP request with a forged Host header to a site running the vulnerable plugin; no additional credentials or privileged access are required. The ability to influence outbound email content makes exploitation straightforward for attackers with network or domain control. The risk is therefore substantial, especially if the organization relies on the default authentication flow and does not enforce host header validation.