CVE-2026-61451 -- CVSS 9.6 Vulnerability Briefing

CVE-2026-61451 | CVSS 9.6 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-61451 is a server-side request forgery (SSRF) or open redirect vulnerability in the Grav API plugin (grav-plugin-api) before version 1.0.4, specifically affecting the forgot-password endpoint's handling of a client-controlled URL parameter.

Technical Detail

The flaw exists in the POST /api/v1/auth/forgot-password endpoint, which accepts an admin_base_url field from the client without validating that the value originates from a trusted or expected source. The sanitizeHttpUrl() function used in the plugin is insufficient to reject malicious or attacker-controlled URLs, allowing an unauthenticated attacker to supply an arbitrary URL that the server may use when constructing password reset links or making outbound requests. Depending on how the application processes this value, exploitation could result in phishing via manipulated reset links sent to users, internal network probing via SSRF, or credential harvesting if reset tokens are embedded in requests to attacker-controlled infrastructure.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability as of July 22, 2026. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation remains theoretical at this time, though the unauthenticated attack surface and high CVSS score of 9.6 make this a priority for remediation before public exploit development occurs.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability.

What To Do

Upgrade grav-plugin-api to version 1.0.4 or later immediately, as this release contains the fix for the improper origin validation in the forgot-password endpoint. If an immediate upgrade is not possible, consider disabling the API plugin or restricting access to the /api/v1/auth/forgot-password endpoint at the network or web application firewall level to trusted IP ranges only. Operators should review server-side logs for anomalous POST requests to the forgot-password endpoint containing unexpected or external URLs in the admin_base_url field as a detection signal. Given the critical CVSS score and unauthenticated nature of the attack vector, patching should be treated as high priority regardless of the current absence of known active exploitation.