Skip to content
Threat Feed
Subscribe

Product

Grav API Plugin (Grav-Plugin-Api) < 1.0.4

1 brief RSS
critical advisory

CVE-2026-61451: Unauthenticated Account Takeover in Grav API Plugin via Password Reset Vulnerability

An unauthenticated attacker can exploit CVE-2026-61451 in Grav API plugin versions prior to 1.0.4, leveraging improper URL validation in the password reset functionality to specify an arbitrary host in the reset link, thereby disclosing valid reset tokens to an attacker-controlled server and enabling full account takeover.

Grav API plugin web-vulnerability account-takeover password-reset grav api
1r 3t 1c