CVE-2026-100870 in Sylius
Summary
by MITRE • 09/27/2026
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 represents a critical security flaw rooted in improper validation of the HTTP Host header during password reset operations. Sylius is an open-source e-commerce platform built on Symfony, and like many web applications relying on framework defaults or custom implementations for authentication flows, it constructs absolute URLs for administrative actions such as password resets. In this specific instance, the application dynamically generates these links by concatenating a base URL derived directly from the Host header present in the incoming HTTP request with the path to the reset endpoint. This design choice assumes that the Host header accurately reflects the intended domain of the service, which is a common but risky assumption when requests can be manipulated or proxied through untrusted intermediaries.
The technical flaw lies in the absence of validation mechanisms for the Host header value before it is used to construct sensitive URLs. When an administrator initiates a password reset via the standard interface, the system generates a unique token and sends an email containing a link that allows the user to set a new password. The URL embedded in this email includes the domain name extracted from the request's Host header at the time of generation. If an attacker can control or forge the Host header value sent during the initial reset request, they can dictate the domain included in the resulting password reset link. This behavior is particularly dangerous because it allows for host header injection attacks where the application trusts user-supplied input without verifying its legitimacy against a whitelist of known trusted domains.
The operational impact of this vulnerability is severe, as it enables unauthenticated attackers to perform account takeover attacks against administrator accounts. By sending a password reset request with a forged Host header pointing to a domain under their control, an attacker can cause the system to generate a reset link that directs users to a malicious site rather than the legitimate Sylius installation. If the target administrator clicks this link, they are redirected to the attacker-controlled server where the token is captured or intercepted. This allows the attacker to complete the password change process using the stolen token, thereby gaining full administrative access to the e-commerce platform. Once inside, attackers can exfiltrate sensitive customer data, modify product listings, manipulate orders, and potentially install persistent backdoors for further exploitation.
This vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), although in this context it extends beyond simple redirection to facilitate credential theft via token interception. It also maps to MITRE ATT&CK technique T1534, specifically the sub-technique of Internal Spearphishing if used within a broader attack chain involving social engineering, or more accurately T1078 for Valid Accounts when considering the final state of gaining administrative privileges through unauthorized means. The core issue is not just redirection but the misuse of user-controlled input to construct security-critical URLs without validation, which falls under CWE-20 Improper Input Validation in the context of URL construction.
Mitigation strategies must focus on enforcing strict domain validation and preventing host header manipulation at multiple layers of the infrastructure. At the application level, Sylius users should upgrade immediately to versions 1.12.25 or later, where this issue has been addressed by implementing proper Host header validation against a predefined list of trusted domains rather than trusting the incoming request's value directly. For organizations unable to patch immediately due to dependency constraints, configuring reverse proxies such as Nginx or Apache to override the Host header with the correct internal domain before passing requests to the application server can provide effective protection. Additionally, enabling strict Content Security Policy headers and ensuring that email links are generated using a fixed base URL configured in environment variables rather than dynamic request data will further reduce exposure. Regular security audits focusing on input validation for all fields used in URL construction are essential to prevent similar vulnerabilities across other features of the platform.