Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover

A critical vulnerability in Appsmith, tracked as CVE-2026-22794, carries a near-maximum CVSS score of 9.7 and enables remote attackers to hijack user accounts by manipulating a single HTTP header. The flaw stems from a lack of validation in how password reset and email verification requests are processed, allowing an attacker to coerce the server into sending authentication tokens to a domain they control.

According to GHSA-7hf5-mc28-xmcv, the server uses the Origin value from request headers as the email link baseUrl without validation, meaning a malicious Origin can be used to misdirect password reset links. The exploitation process is straightforward: an attacker requests a password reset for a target user, sets the Origin header to a malicious domain, the server sends a reset token in a link using that domain, and the victim’s clicks leak the token to the attacker.

The issue affects Appsmith version 1.92, with a fix in version 1.93, and administrators running self-hosted instances are urged to upgrade immediately to mitigate the risk of account takeover, personal data exposure, phishing and malicious redirection.