CVE-2026-100870: Sylius Host Header Flaw
TL;DR - CVE-2026-100870 affects Sylius administrator password-reset URL generation. - An attacker may abuse an unvalidated HTTP
Hostheader to redirect a reset token to an attacker-controlled domain. - Affected branches are fixed in 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9. - No confirmed active exploitation is established, but public remediation details make prompt patching appropriate.
Summary
CVE-2026-100870 is a high-severity vulnerability in the Sylius open-source e-commerce platform. The flaw affects administrator password-reset URL generation: vulnerable Sylius versions can use a request-supplied Host header when constructing the link sent to an administrator.
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-100870 |
| CVSS base score | 8.8 |
| Attack vector | Network, based on the remote HTTP request described in the record; the exact NVD vector string was not available in the supplied data |
| Authentication required | No |
| Patch available | Yes |
| Affected product | Sylius e-commerce platform |
| CISA KEV status | Not listed |
An attacker who knows or can determine an administrator’s email address may submit a password-reset request with a forged Host header. If the resulting email contains a link to an attacker-controlled domain, the attacker may capture the valid reset token and use it to take over the administrator account. The practical impact is account takeover, not merely incorrect URL formatting.
Analyst’s Take: Patch internet-facing Sylius installations first, especially where administrator email addresses are predictable or publicly exposed. The lack of a CISA KEV listing and confirmed in-the-wild exploitation does not offset the possibility of administrator takeover when a reset token is captured.
Organizations can also use this incident to review broader supplier and platform exposure through third-party risk management, particularly where e-commerce systems are hosted or maintained by external providers.
Root Cause
The root cause is improper trust of the incoming HTTP Host header while constructing administrator password-reset URLs. The application should derive externally usable links from a validated, canonical application URL or a strictly trusted host configuration. Instead, the vulnerable behavior allows request data to influence the destination host embedded in the reset link.
A typical attack path requires several conditions. The attacker must know an administrator email address, the reset workflow must be reachable, and the forged host value must reach the application through the reverse proxy and web stack. The administrator must then follow the altered link, or the attacker must otherwise obtain the token. These dependencies affect exploitability but do not remove the risk for internet-facing stores.
Treat the issue as a password-reset poisoning vulnerability. Successful exploitation can provide administrator privileges, allowing changes to catalog data, orders, customer information, configuration, integrations, or other functions exposed by the Sylius administration interface.
Who’s Exposed
The NVD description identifies these vulnerable Sylius ranges:
| Sylius branch | Vulnerable versions | Fixed version |
|---|---|---|
| 1.12 | Versions before 1.12.25 | 1.12.25 |
| 1.13 | Versions before 1.13.17 | 1.13.17 |
| 1.14 | Versions before 1.14.20 | 1.14.20 |
| 2.1 | Versions before 2.1.16 | 2.1.16 |
| 2.2 | Versions before 2.2.9 | 2.2.9 |
Deployments on any listed branch below its corresponding fixed release should be considered exposed. Organizations using custom Sylius distributions, vendor-managed images, or downstream packages should verify the embedded Sylius version rather than relying only on the application’s visible release label.
The highest-priority targets are internet-facing stores with administrator password-reset functionality enabled, administrators using externally delivered email, and deployments where the reverse proxy forwards arbitrary or insufficiently validated host values. Internal-only environments are not automatically safe. An attacker with network access to the application or its proxy may still attempt the workflow.
Severity Breakdown
The assigned CVSS base score is 8.8, rated high. The available research data does not include the complete CVSS vector string, so the exact component values should be verified directly in the NVD record before the score is used in automated compliance, prioritization, or risk calculations.
The available description establishes several practical characteristics:
| Severity characteristic | Assessment |
|---|---|
| Remote exploitation | Yes, through HTTP requests |
| Authentication | Not required to submit the reset request |
| User interaction | Likely required if the administrator must follow the reset link |
| Impact | Potential administrator account takeover |
| Privilege impact | High if the reset token is obtained |
| Confidentiality and integrity risk | Potentially high after administrative compromise |
| Availability impact | Not specified in the supplied record |
Do not replace the published 8.8 score with an assumed vector. The exact vector was not returned in the research data, and the NVD record should remain the authoritative source for component-level scoring.
Exploitation Status
CVE-2026-100870 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. No CISA date added, federal remediation deadline, required action, or ransomware-campaign designation applies. The available records also do not establish confirmed exploitation in the wild.
A public GitHub security advisory, pull request, and fixing commit are available. These references expose the affected behavior and remediation change, and they may provide enough detail for researchers to build a proof of concept. The supplied sources did not identify a verified standalone public exploit repository or confirm active exploitation. Defenders should describe the status as public remediation and technical details available; confirmed in-the-wild exploitation not established.
Password-reset poisoning can lead directly to administrator takeover, so the absence of a KEV listing should not be interpreted as evidence of low risk. Internet-facing installations should be patched promptly, particularly where administrator email addresses are predictable or publicly exposed.
Sources
The primary vulnerability record is the NVD entry for CVE-2026-100870. It provides the affected version ranges, severity score, and description of the Host header issue:
Sylius remediation references include the project repository, public security advisory, fixing pull request, fixing commit, and fixed 2.2.9 release:
- Sylius repository
- GitHub security advisory GHSA-77w3-2367-7xvq
- Pull request 19215
- Fixing commit
- Sylius 2.2.9 release
CISA’s catalog is the relevant source for known exploitation status. As of the research date, CVE-2026-100870 was not listed:
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start by reviewing reverse-proxy, web-server, application, and mail-delivery telemetry for password-reset requests associated with unusual hostnames. The relevant event may not use a consistent endpoint name across Sylius deployments. Identify the configured administrator password-reset route in the application, then correlate it with the request host and subsequent email delivery.
Look for requests to a password-reset route where the Host value is not one of the organization’s approved canonical domains. Also check for reset emails containing links to domains outside the organization, followed by administrator password changes, new sessions, MFA changes, or other privileged activity.
Technical Notes
The following examples are starting points. Adjust the route, field names, and log format to match the deployment:
# Search common access logs for likely reset requests and suspicious Host values
grep -Ei 'password|reset|forgot' /var/log/nginx/access.log \
| grep -Ev 'Host: (shop\\.example\\.com|admin\\.example\\.com)'
For structured logs in Elasticsearch or an equivalent SIEM, a conceptual query is:
http.request.method: POST
and url.path: ("*password*" or "*reset*" or "*forgot*")
and not http.host: ("shop.example.com" or "admin.example.com")
Alert on combinations rather than a single indicator: a reset request with an unapproved host, a reset email containing an external URL, and a subsequent administrator password change or new administrative session. Preserve the original Host, X-Forwarded-Host, client IP, user agent, requested path, and timestamp. These fields help determine whether a proxy rewrote the request before it reached Sylius.
Remediation Steps
Upgrade to the fixed release for the deployed branch:
- Sylius 1.12.25 or later
- Sylius 1.13.17 or later
- Sylius 1.14.20 or later
- Sylius 2.1.16 or later
- Sylius 2.2.9 or later
Where operationally possible, move to the latest supported Sylius release rather than stopping at the minimum branch fix. Before changing production, test password-reset generation, administrator email delivery, reverse-proxy behavior, and any custom authentication extensions.
Technical Notes
For Composer-managed installations, first identify the installed package and branch:
composer show sylius/sylius
composer why-not sylius/sylius 2.2.9
Then require the appropriate fixed version. Use the branch-specific command that matches the application’s supported release line:
composer require sylius/sylius:1.12.25 --update-with-dependencies
# or
composer require sylius/sylius:1.13.17 --update-with-dependencies
# or
composer require sylius/sylius:1.14.20 --update-with-dependencies
# or
composer require sylius/sylius:2.1.16 --update-with-dependencies
# or
composer require sylius/sylius:2.2.9 --update-with-dependencies
Do not run these commands blindly on a production system without checking the project’s dependency constraints and supported branch. Confirm the resulting lockfile, deploy the tested artifact, and verify the installed version with composer show sylius/sylius.
As a compensating control, configure the reverse proxy to accept only approved hostnames and reject unexpected Host and forwarded-host values. The application should also use a configured canonical URL for password-reset links. Rate-limit reset requests, enable MFA for administrator accounts, and invalidate outstanding administrator reset tokens if exposure is suspected.
Use unique administrator credentials and store them in an approved password manager such as 1Password. Rotate administrator credentials and revoke active sessions when there is evidence that a reset token or account may have been compromised.
For a broader prioritization framework, see why “patch everything” is bad advice and how risk-based patching can help focus urgent remediation on internet-facing systems.
Incident Response Considerations
If a vulnerable installation may have received a malicious reset request, preserve relevant web, proxy, application, and email logs before rotating or deleting them. Investigate:
- Password-reset requests using unapproved
HostorX-Forwarded-Hostvalues - Reset emails containing external domains
- Administrator password changes shortly after suspicious reset activity
- New administrator sessions, API keys, MFA changes, or privilege changes
- Unexpected catalog, order, customer, configuration, or integration changes
Invalidate outstanding administrator password-reset tokens, rotate affected credentials, revoke active sessions, and review administrative actions during the suspected exposure window. If compromise is confirmed, follow the organization’s incident-response process and assess whether customer, payment, or regulatory notification requirements apply.