CVE-2026-27812
Last modified
CVE-2026-27812 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit this flaw to inject their own domain into the password reset link, leading to the potential for account takeover. The vulnerability has been fixed in version v0.1.85. If upgrading is not immediately possible, users can mitigate the vulnerability by disabling the "forgot password" feature until an upgrade to a patched version can be performed. This will prevent attackers from exploiting the vulnerability via the affected endpoint.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sub2api | Sub2api | < 0.1.85 |
References
- https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27812?
How severe is CVE-2026-27812?
How do I fix CVE-2026-27812?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27807MarkUs is a web application for the submission and grading o…4.9
- CVE-2026-27808Mailpit is an email testing tool and API for developers. Pri…8.6
- CVE-2026-27809psd-tools is a Python package for working with Adobe Photosh…9.1
- CVE-2026-2781Integer overflow in the Libraries component in NSS. This vul…9.8
- CVE-2026-27810calibre is a cross-platform e-book manager for viewing, conv…6.4
- CVE-2026-27811Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…8.8
- CVE-2026-27813EVerest is an EV charging software stack. Versions prior to …5.3
- CVE-2026-27814EVerest is an EV charging software stack. Versions prior to …4.2
- CVE-2026-27815EVerest is an EV charging software stack. Prior to versions …9.1
- CVE-2026-27816EVerest is an EV charging software stack. Prior to versions …9.1
- CVE-2026-27818TerriaJS-Server is a NodeJS Express server for TerriaJS, a l…7.5
- CVE-2026-27819Vikunja is an open-source self-hosted task management platfo…7.2
Are you affected by CVE-2026-27812?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST