Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
HighPublic exploit

Appsmith Origin Header Injection Account Takeover

IdentifiersCVE-2026-22794CWE-346· Origin Validation Error

CVE-2026-22794 is a critical authentication flaw in Appsmith affecting versions prior to 1.93 in the 1.x branch. The server uses the client-supplied HTTP Origin request header as the base URL when generating password reset and email verification links, without validating that the origin is trusted. Reported vulnerable logic includes the forgot-password flow at /api/v1/users/forgotPassword, where the Origin header is read and assigned as the email link baseUrl. An attacker can submit a password reset request for a victim account while supplying an attacker-controlled Origin value, causing Appsmith to send a legitimate email containing a reset or verification link that points to the attacker’s domain but includes a valid token. When the victim clicks the link, the token is exposed to the attacker, who can then use it against the real Appsmith instance to reset the victim’s password and hijack the account. Appsmith 2.x is reported as not vulnerable.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to full account takeover, including administrator accounts. With a compromised account, an attacker may reset credentials, access the victim’s Appsmith workspace, manage users and roles, modify applications, alter security settings, and access connected internal data sources, APIs, and business data exposed through Appsmith. The issue also creates phishing and trust-abuse risk because the malicious link is delivered in a legitimate Appsmith-generated email.

Mitigation

If you can’t patch tonight, do this now.

As defense in depth, strip, override, or strictly validate the Origin header at a reverse proxy or WAF for password reset and email verification requests. Restrict exposure of self-hosted Appsmith instances where possible, monitor forgot-password and email-verification activity for abuse, and enable MFA for Appsmith accounts if supported. Administrators should also review logs for suspicious reset activity and prioritize patching internet-exposed 1.x deployments.

Remediation

Patch, then assume compromise.

Upgrade Appsmith to version 1.93 or later. The fix reportedly introduces stricter Origin validation and enforces use of a trusted base URL for email link generation rather than blindly trusting the request Origin header. Where applicable, configure the trusted application base URL explicitly (for example, APPSMITH_BASE_URL) so password reset and email verification links are generated only for the legitimate Appsmith domain.
PUBLIC EXPLOITS

Exploits

2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 2 / 2 TOTALView more in app
Ashwesker-CVE-2026-22794MaturityPoCFrameworknucleiVerified exploit

Repository contains a PoC exploit and a Nuclei template for CVE-2026-22794 affecting Appsmith <= 1.92. The core issue is Origin header trust during password reset link generation: an unauthenticated attacker sends a forgot-password request with a spoofed Origin (attacker domain), causing the emailed reset link to point to attacker infrastructure; when the victim clicks, the reset token can be captured and used to reset the victim’s password (account takeover). Structure: - CVE-2026-22794.py: Python PoC with two modes. (1) --check: GET / and look for “Appsmith” in HTML and parseConfig('vX.Y') version parsing; flags vulnerable if version <= 1.92 or if version cannot be extracted but Appsmith is detected. (2) exploit: POST /api/v1/users/forgotPassword with JSON {email: <victim>} and Origin: https://<evil_domain>; reports success on 200/201/202 and “success” in body. - CVE-2026-22794.yaml: Nuclei template performing (a) GET /api/v1/users to fingerprint Appsmith and optionally extract X-Appsmith-Version, (b) POST /api/v1/users/forgotPassword with a fixed Origin (evil-attacker-domain.com) and test email to validate behavior, and (c) an OPTIONS preflight check looking for Access-Control-Allow-Origin reflecting/allowing the attacker domain or wildcard. - README.md: Detailed explanation, usage examples, and an attacker-side token capture example (index.php writing tokens.txt). Notable targeting/assumptions: - Requires exposed Appsmith HTTP(S) endpoint. - Full impact depends on outbound email being configured and victim interaction (clicking reset link).

AshweskerDisclosed Jan 28, 2026pythonyamlnetwork
CVE-2026-22794-POCMaturityPoCVerified exploit

Repository purpose: PoC/operational exploit for CVE-2026-22794 (Appsmith Origin header injection) enabling password reset link hijacking and account takeover. Structure: - exploit.py: Main Python exploit. Implements (a) a local HTTP listener (BaseHTTPRequestHandler) to capture reset tokens from victim clicks (parses query param `token`), logs requests, and appends tokens to `captured_tokens.txt`; (b) client-side routines (per README/CLI) to send a malicious password reset request to the target with a forged `Origin` header pointing to an attacker-controlled URL; and (c) a follow-on step to use a captured token to reset the password on the Appsmith instance. Also includes convenience output (colorama), threading to run the capture server, and CLI flags such as --target, --email, --attacker-url, --listen, --port, --check, and reset-token/new-password (as documented). - nuclei/CVE-2026-22794.yaml: Nuclei template for detection/fingerprinting. Checks `/api/v1/users` for Appsmith-like responses and optionally extracts `X-Appsmith-Version`. Sends a test POST to `/api/v1/users/forgotPassword` with a malicious Origin and matches on JSON success indicators; includes an OPTIONS-based CORS/Origin acceptance check. - docs/technical_analysis.md and README.md: Detailed explanation of root cause (trusting Origin to build reset URL), attack chain, and remediation guidance. - requirements.txt: requests, colorama, urllib3. Exploit capabilities: - Network-based unauthenticated trigger of password reset for an arbitrary email. - Origin header manipulation to cause Appsmith to generate reset links pointing to attacker infrastructure. - Token capture server that records tokens and client IPs and serves a benign-looking 503 page to reduce suspicion. - Post-capture account takeover by submitting the stolen token to the reset-password endpoint with a chosen new password. Notable targeting details: - Primary target endpoint: POST `/api/v1/users/forgotPassword` with attacker-controlled `Origin`. - Token exfiltration occurs when victim visits attacker URL path `/user/resetPassword?token=...`. - Follow-on action: POST `/api/v1/users/resetPassword` using the stolen token. Overall, this is an operational PoC (not a framework module) combining exploitation + token collection + password reset automation, plus a separate Nuclei detection template.

MalikHamza7Disclosed Jan 23, 2026pythonyamlnetwork
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
AppsmithAppsmithapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity11

Community discussion across Reddit, Mastodon, and other social sources.