Read the docs
TI-2026-22165 Aliases CVE-2026-27812

Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover

Priority MEDIUM 43CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning (Host Header / Forwarded Header trust issue), which allows attackers to manipulate the password reset link. Attackers can exploit this flaw to inject their own domain into the password reset link, leading to the potential for account takeover. The vulnerability has been fixed in version v0.1.85. If upgrading is not immediately possible, users can mitigate the vulnerability by disabling the "forgot password" feature until an upgrade to a patched version can be performed. This will prevent attackers from exploiting the vulnerability via the affected endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-07
Fix Fixed sub2api (Wei-Shaw): 0.1.85

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wei-Shawsub2apibefore 0.1.850.1.85Patch availableCNA
  • sub2api VendorWei-Shaw Affected before 0.1.85 Fixed in 0.1.85 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sub2api:sub2api:*:*:*:*:*:*:*:*before 0.1.85VulnerableSub2api
  • cpe:2.3:a:sub2api:sub2api:*:*:*:*:*:*:*:* Versions before 0.1.85 Vulnerable ·Sub2api

Remediation

  • Fix · CNA sub2api (Wei-Shaw) Fixed in 0.1.85

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27812

References

Advisory 1

  • TI-2026-51286 Path traversal in Wei-Shaw sub2api CVSS 3.1HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences