Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-100870Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
High 8.8
In plain English
A high-severity security flaw in Sylius from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.
Affected products (as reported)
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-77w3-2367-7xvq) vendor-advisory
- https://github.com/Sylius/Sylius/pull/19215 patch, issue-tracking
- https://github.com/Sylius/Sylius/commit/1255d75b20d3d88a5e5c8d46791504134c838480 patch
- Sylius v2.2.9 Release Notes release-notes
- https://github.com/Sylius/Sylius product
- VulnCheck Advisory: Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header third-party-advisory