CVE-2026-27812 is a critical password reset poisoning flaw (CVSS 9.1) in Sub2API, an AI API gateway. Before version 0.1.85, an attacker can steer the domain in a reset link and take over accounts. Upgrade to 0.1.85, or disable the forgot password feature until you can. The record does not mark it as exploited.
What's affected
Sub2API, all versions before 0.1.85. The fixed version is 0.1.85, per the GitHub advisory.
Sub2API manages API quotas drawn from AI product subscriptions, so account takeover is a real concern for anyone who runs it.
How to check if you're exposed
Find the version of Sub2API you deployed. Check the release or image tag in your deployment config, and the version shown by the application if it reports one.
Then check how the service sits behind your proxy. The advisory describes trust in Host and forwarded headers, so look at whether your reverse proxy sets those headers itself or passes through whatever clients send.
Search your outbound mail logs for password reset emails whose links point to a domain that is not yours.
What to do now
- Upgrade Sub2API to 0.1.85 or later.
- If you cannot upgrade now, disable the forgot password feature, as the advisory suggests.
- Make your reverse proxy set the Host and forwarded headers itself and drop any client supplied values.
- Review recent reset emails and password changes for accounts you cannot explain, and reset credentials where needed.
- Rotate API keys for accounts that might have been affected.
Why it matters
Password reset poisoning happens when an application builds the link in a reset email from request headers the client controls. An attacker asks for a reset for a victim's address while sending their own domain in the header. The victim receives a genuine email whose link points at the attacker, and the token goes with it. NVD classifies the flaw as CWE-116 (Improper Encoding or Escaping of Output).
The durable fix is to build links from a configured, trusted base URL and never from the request. A proxy that sanitises headers is a good second layer.
Building reset links safely
If you run Sub2API behind a reverse proxy, the fix in 0.1.85 is the main change, but the proxy settings matter as well.
Decide which component owns the public host name. Set the Host header at the edge and strip forwarded host headers that arrive from clients. Then the application sees only values you set.
If you write similar code, build reset links from a configured base URL. Never take the domain from the request.
After the upgrade, request a reset for a test account and check that the link points at your own domain.
If you disabled forgot password as a stopgap, turn it back on only after the upgrade and the proxy check, and tell your users why the feature was off for a while. Add the check to your release routine so future proxy changes do not undo it.
Try it yourself
A check at the pull request stage can catch outdated versions before they reach production. This demo shows how a gate behaves.
Click through it at your own pace, or open it full screen.
Quick check
Is the forgot password feature the only path?
The advisory names the password reset endpoint as the vector and suggests disabling forgot password as the workaround.
Who is at risk?
Anyone running Sub2API before 0.1.85 with the reset feature on.
Sources
Last reviewed: 19 October 2026.
