Password Reset Token Hijacking in Sylius

Executive Summary

CVE-2026-100870 is a high-severity vulnerability in Sylius, an open-source e-commerce framework. It involves a Host header injection flaw in administrator password-reset email links. Attackers can forge the Host header in a request to manipulate the reset link's domain, redirecting the token to their own server. When an administrator clicks the malicious link, the valid reset token is sent to the attacker, allowing them to take over the admin account.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Sylius instance uses a version prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9. Run commands like 'composer show sylius/sylius' or check the version in your Sylius admin panel. Inspect password reset emails for links using the Host header instead of the configured channel hostname.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to gain unauthorized access to administrator accounts by intercepting password reset tokens. If exploited, attackers could take control of the admin panel, potentially leading to data breaches, unauthorized transactions, or further compromise of the e-commerce system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A successful exploit may result in non-compliance, legal penalties, and reputational damage due to compromised user data.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Sylius to a patched version (1.12.25, 1.13.17, 1.14.20, 2.1.16, or 2.2.9 or later).
• Configure trusted hosts in your web server or application to reject spoofed Host headers.
• Apply a workaround by decorating the mailer to generate reset links from the channel's configured hostname instead of the Host header.

Useful 0 Not Useful 0