CVE-2026-27812
📋 TL;DR
CVE-2026-27812 is a password reset poisoning vulnerability in Sub2API versions before 0.1.85 that allows attackers to manipulate password reset links by injecting their own domain. This could lead to account takeover by tricking users into resetting passwords through attacker-controlled sites. Organizations using vulnerable Sub2API versions are affected.
💻 Affected Systems
- Sub2API
📦 What is this software?
Sub2api by Sub2api
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all Sub2API users, potentially leading to unauthorized access to AI API quotas and subscription management systems.
Likely Case
Targeted account takeover of specific users, enabling attackers to steal API quotas or manipulate subscription settings.
If Mitigated
No impact if password reset feature is disabled or proper host header validation is implemented.
🎯 Exploit Status
Exploitation requires network access to the vulnerable endpoint and ability to manipulate HTTP headers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.1.85
Vendor Advisory: https://github.com/Wei-Shaw/sub2api/security/advisories/GHSA-vc2q-289v-74g3
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Sub2API service. 3. Update to v0.1.85 or later. 4. Restart Sub2API service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable Password Reset
allTemporarily disable the forgot password feature to prevent exploitation.
# Configuration setting depends on deployment method
# Check Sub2API documentation for disable_password_reset setting
🧯 If You Can't Patch
- Implement WAF rules to validate and sanitize Host and Forwarded headers
- Use network segmentation to restrict access to password reset endpoints
🔍 How to Verify
Check if Vulnerable:
Check Sub2API version: if version < 0.1.85 and password reset is enabled, system is vulnerable.Check Version:
sub2api --version or check package manager/container image tagVerify Fix Applied:
Confirm version is 0.1.85 or later and test password reset functionality with manipulated headers.📡 Detection & Monitoring
Log Indicators:
- Unusual Host header values in password reset requests
- Password reset attempts with suspicious referrers
Network Indicators:
- HTTP requests to password reset endpoint with manipulated headers
- Outbound connections to unusual domains after password reset
SIEM Query:
source="sub2api" AND (uri_path="/password-reset" OR uri_path="/forgot-password") AND (header.host CONTAINS suspicious_domain OR header.forwarded CONTAINS suspicious_domain)