CVE-2026-27812: Sub2API Password Reset Poisoning via Host Header Trust Leading to Account Takeover
CVE-2026-27812 affects Sub2API versions before 0.1.85 and is recorded as a password reset poisoning issue caused by trusting Host or Forwarded headers. Successful abuse could let an attacker insert their own domain into password reset links and potentially take over accounts. The record names v0.1.85 as the fixed version and describes disabling the forgot password feature as an interim mitigation.
Overview
Sub2API is an AI API gateway platform used to distribute and manage API quotas from AI product subscriptions. CVE-2026-27812 is recorded as a password reset poisoning issue, in which the application trusts Host or Forwarded header values when building password reset links.
Impact
If an attacker can influence the reset link, a victim may be directed to a domain the attacker controls, which could lead to account takeover. NVD assigns a CVSS score of 9.1 and the record lists high confidentiality and integrity impact.
Affected products and versions
- Sub2api Sub2api: before 0.1.85
- Wei-Shaw Sub2api: before 0.1.85
The record names v0.1.85 as the version containing the fix. Both product entries reference the same range.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC record marks exploitation as none and automatable as yes, and the EPSS probability is 0.00453.
Remediation and mitigation
- Upgrade to v0.1.85, the version the record identifies as fixed. See the GitHub security advisory GHSA-vc2q-289v-74g3.
- If an upgrade cannot be applied immediately, the record recommends disabling the forgot password feature until a patched version is deployed.
- Review how the application builds reset links and avoid deriving the link host from request headers that clients can control.
Detection guidance
- Review password reset request logs for unexpected Host or forwarding header values.
- Check outgoing reset emails for links that point to unfamiliar domains.
- Monitor for password changes or reset completions that users did not request.
Limitations of the available information
The record does not identify the exact vulnerable endpoint, the full set of headers involved, or deployment conditions that make the issue reachable. Whether a given installation is exposed is unknown. The record gives a CWE of CWE-116 while describing a header trust issue, and the only vendor reference is the GitHub advisory.
Frequently asked questions
Which Sub2API versions are affected by CVE-2026-27812?
The record lists Sub2api Sub2api and Wei-Shaw Sub2api as affected before 0.1.85.
What is the recommended interim mitigation if I cannot upgrade right away?
The record recommends disabling the forgot password feature until a patched version such as v0.1.85 can be deployed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.