Skip to content
Threat Feed
Subscribe

Product

Sylius (< 1.12.25, < 1.13.17, < 1.14.20, < 2.1.16, < 2.2.9)

1 brief RSS
high advisory

Host Header Injection in Sylius Password Reset Mechanism

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to a password reset poisoning attack, allowing unauthenticated attackers to hijack administrator accounts via Host header manipulation.

Sylius +1 vulnerability web-application account-takeover authentication-bypass privilege-escalation financial-fraud e-commerce cve-2026-100872
3t 1c