Advisory · CVE-2026-100870
Sylius admin password resets poisoned through the Host header
Sylius built admin password-reset links from the unvalidated request Host header, letting unauthenticated attackers divert reset tokens to their own domains and seize admin accounts.
- Vendor
- Sylius
- Product
- Sylius
- Identifier / CWE
- CVE-2026-100870
CWE-640 - Action timing
- Immediate
Explain it like I’m five
Sylius wrote the return address for password-reset letters from whatever the visitor claimed the shop's address was. An attacker claimed a fake address, collected the reset letters meant for admins, and used them to take over the admin accounts.
- 01Known admin email
The attacker starts with a known administrator email address for the target Sylius shop.
- 02Forged Host
They request a password reset while sending a forged Host header pointing at an attacker-controlled domain.
- 03Token diverted
Sylius builds the reset link from the unvalidated Host header, so the valid reset token goes to the attacker's domain.
- 04Admin seized
The attacker follows the intercepted link and sets a new password on the administrator account.
What happened
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 built administrator password-reset links using the request Host header without validation. An unauthenticated attacker could request a password reset for a known administrator email address with a forged Host header and have the valid reset token delivered to an attacker-controlled domain, then use the intercepted token to take over the administrator account.
The flaw is fixed in Sylius 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9.
What to do
- Upgrade Sylius to a fixed release on your branch (1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9).
- Review password-reset request logs for requests carrying unexpected Host headers.
- Audit administrator accounts for password changes or new sessions that cannot be explained, and force password resets on admin accounts if exposure is possible.
- As defense in depth, terminate TLS and validate Host headers at the reverse proxy or load balancer in front of the shop.
Management note
Password reset is the front door’s spare key, and this flaw handed copies to strangers. Patching is quick, but the log review matters: a forged Host header leaves a trace, and any admin reset during the exposure window deserves a second look.