CVE-2026-27812

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27812", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:31:33.267Z", "datePublished": "2026-02-26T00:00:10.239Z", "dateUpdated": "2026-02-26T14:53:58.840Z"}, "containers": {"cna": {"title": "Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3"}], "affected": [{"vendor": "Wei-Shaw", "product": "sub2api", "versions": [{"version": "< 0.1.85", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T00:00:10.239Z"}, "descriptions": [{"lang": "en", "value": "Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit this flaw to inject their own domain into the password reset link, leading to the potential for account takeover. The vulnerability has been fixed in version v0.1.85. If upgrading is not immediately possible, users can mitigate the vulnerability by disabling the \"forgot password\" feature until an upgrade to a patched version can be performed. This will prevent attackers from exploiting the vulnerability via the affected endpoint."}], "source": {"advisory": "GHSA-vc2q-289v-74g3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:53:43.946432Z", "id": "CVE-2026-27812", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:53:58.840Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T14:53:43.946432Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:53:53.409Z"}}], "cna": {"title": "Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover", "source": {"advisory": "GHSA-vc2q-289v-74g3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Wei-Shaw", "product": "sub2api", "versions": [{"status": "affected", "version": "< 0.1.85"}]}], "references": [{"url": "https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3", "name": "https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit this flaw to inject their own domain into the password reset link, leading to the potential for account takeover. The vulnerability has been fixed in version v0.1.85. If upgrading is not immediately possible, users can mitigate the vulnerability by disabling the \"forgot password\" feature until an upgrade to a patched version can be performed. This will prevent attackers from exploiting the vulnerability via the affected endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T00:00:10.239Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27812", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:53:58.840Z", "dateReserved": "2026-02-24T02:31:33.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T00:00:10.239Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sub2api", "vendor": "Wei-Shaw", "versions": [{"status": "affected", "version": "< 0.1.85"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sub2api:sub2api:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE645367-957B-439F-97E6-91C32C6D32AC", "versionEndExcluding": "0.1.85", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit this flaw to inject their own domain into the password reset link, leading to the potential for account takeover. The vulnerability has been fixed in version v0.1.85. If upgrading is not immediately possible, users can mitigate the vulnerability by disabling the \"forgot password\" feature until an upgrade to a patched version can be performed. This will prevent attackers from exploiting the vulnerability via the affected endpoint."}, {"lang": "es", "value": "Sub2API es una plataforma de pasarela de API de IA dise\u00f1ada para distribuir y gestionar cuotas de API de suscripciones de productos de IA. Una vulnerabilidad en versiones anteriores a la 0.1.85 es un Envenenamiento de Restablecimiento de Contrase\u00f1a (problema de confianza en el encabezado Host / Forwarded), que permite a los atacantes manipular el enlace de restablecimiento de contrase\u00f1a. Los atacantes pueden exploit esta falla para inyectar su propio dominio en el enlace de restablecimiento de contrase\u00f1a, lo que lleva al potencial de toma de control de la cuenta. La vulnerabilidad ha sido corregida en la versi\u00f3n v0.1.85. Si la actualizaci\u00f3n no es posible de inmediato, los usuarios pueden mitigar la vulnerabilidad deshabilitando la funci\u00f3n 'olvid\u00e9 mi contrase\u00f1a' hasta que se pueda realizar una actualizaci\u00f3n a una versi\u00f3n parcheada. Esto evitar\u00e1 que los atacantes exploten la vulnerabilidad a trav\u00e9s del endpoint afectado."}], "id": "CVE-2026-27812", "lastModified": "2026-06-17T10:27:43.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27812", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:53:43.946432Z", "version": "2.0.3"}}]}, "published": "2026-02-26T00:16:26.467", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.1.85)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sub2api", "source": "cna", "vendor": "Wei-Shaw"}, "product": "sub2api", "vendor": "wei-shaw"}], "analysis": {"en": {"generated_at": "2026-04-18T19:35:34.786745+00:00", "value": {"mitigation_remediation": ["Upgrade the sub2api software to version 0.1.85 or later, which contains the host\u2011header validation fix.", "Disable the 'forgot password' feature entirely until a patched version is deployed, preventing attackers from reaching the vulnerable endpoint.", "Configure the deployment or web server to reject or validate Host and Forwarded headers against a whitelist of trusted domains to mitigate similar header\u2011trust issues."], "summary": {"action": "Immediate Patch", "impact": "Account Takeover"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Wei\u2011Shaw sub2api product in all releases before 0.1.85. Organizations running any prior version of the sub2api software should verify their install and ensure an upgrade to v0.1.85 or later.", "description_and_impact": "Sub2API, an AI API gateway, has a Host Header and Forwarded Header trust issue that enables password reset poisoning. Attackers can craft a request that injects a malicious domain into the reset link, allowing them to reset one or more user accounts. The vulnerability is classified as CWE\u2011116 and, if exploited, leads to unauthorized account takeover and potential compromise of all data accessed through the affected accounts.", "risk_and_exploitability": "The CVSS score of 8 indicates high severity. The EPSS score is below 1%, suggesting that exploitation is considered unlikely but not impossible. The flaw is not listed in CISA\u2019s KEV catalog. An attacker can exploit the vulnerability remotely by sending a crafted HTTP request to the password\u2011reset endpoint, manipulating the Host or Forwarded headers. The description does not explicitly state whether prior authentication is required to exploit this flaw; based on typical password\u2011reset flows, it is inferred that the endpoint may be accessed without authentication, but this inference is not guaranteed. If successfully exploited, full takeover of the affected account is possible."}}}}, "created": "2026-02-26T13:10:27.573851+00:00", "updated": "2026-04-18T19:45:08.961502+00:00", "vendors": ["wei-shaw", "wei-shaw$PRODUCT$sub2api"]}