Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Sylius admin password reset can be redirected to attacker

CVE-2026-100870 · published 22 days ago
Summary

Sylius builds password‑reset links for administrators using the website address sent by the browser, without checking it. An attacker can trick the system into sending those links to a domain they control, capture the reset token, and take over an admin account. Update Sylius to the latest version or apply the vendor’s patch to validate the host name before generating reset links.

What to do
  • Update sylius sylius to version 1.12.25 or later.
Affected software
VendorProductAffected versions
sylius sylius < 1.12.25
Original advisory text
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100870 · NVD
CVE-2026-100870 · MITRE
CVE-2026-100870 · OSV
GHSA-77w3-2367-7xvq · GHSA
Track software like this
Free during beta