CVE-2026-100870: Sylius

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.

Affected products

• Sylius Sylius: from 1.12.0, before 1.12.25 (fixed in 1.12.25); from 1.13.0, before 1.13.17 (fixed in 1.13.17); from 1.14.0, before 1.14.20 (fixed in 1.14.20); from 2.0.0, before 2.1.16 (fixed in 2.1.16); from 2.2.0, before 2.2.9 (fixed in 2.2.9)

Published 2026-09-27. Last modified 2026-09-30.