CVE-2026-61451

**1. Summary** This is a critical input validation vulnerability in the Grav API plugin that allows an unauthenticated attacker to manipulate the password reset process. Because the plugin fails to verify the hostname in the base URL, an attacker can trick the system into sending password reset emails with links pointing to a malicious server. If a victim clicks this link, the attacker steals the valid reset token, allowing them to reset the victim's password and take over the account. **2. Who is affected** * **Product:** Grav CMS installations using the `grav-plugin-api` (Grav API Plugin). * **Affected Versions:** All versions prior to **1.0.4**. **3. Attacker Impact** An unauthenticated attacker can gain full access to any user account, including administrator accounts, by forcing a password reset and intercepting the reset token. This results in a complete account takeover (ATO) and potential compromise of the entire CMS. **4. Recommended Remediation** * **Update Immediately:** Upgrade the Grav API plugin to version **1.0.4** or later. * **Mitigation:** If an update cannot be applied immediately, restrict access to the `/api/v1/auth/forgot-password` endpoint to trusted IP addresses or disable the API plugin temporarily. * **Post-Patch Actions:** Force a password reset for all users if you suspect this vulnerability was exploited prior to patching.