Critical · published January 12, 2026
🚨 An attacker can craft malicious email links to take over accounts with a simple control over the request origin! 🔥 Think of it like a hotel receptionist who sends you a confirmation email for your stay, but they mistakenly use a fake email address you never provided. This means anyone could show up pretending to be you! If you’re running an affected version of Appsmith, attackers could steal authentication tokens by directing password resets to their own domain, leading to absolute chaos with account takeovers. Imagine losing access to sensitive admin panels — a nightmare scenario!
Think of it like a hotel receptionist who sends you a confirmation email for your stay, but they mistakenly use a fake email address you never provided. This means anyone could show up pretending to be you! This vulnerability arises because the Appsmith server uses the Origin request header without proper validation, allowing attackers to generate links pointing to malicious sites that could exploit this weakness.
If you’re running an affected version of Appsmith, attackers could steal authentication tokens by directing password resets to their own domain, leading to absolute chaos with account takeovers. Imagine losing access to sensitive admin panels — a nightmare scenario! To protect your application, upgrade to Appsmith version 1.93 immediately to patch this critical vulnerability. Additionally, review your email link generation process to ensure it validates the Origin properly going forward. You've got this! Follow these steps, and you'll be back in control in no time! 🛡️