CVE-2026-22794

CVE-2026-22794 is a critical vulnerability in Appsmith, a platform for building internal tools, affecting versions prior to 1.93. The flaw allows an attacker to manipulate the Origin header in requests, leading to the generation of malicious password reset or email verification links. This can expose authentication tokens and potentially result in account takeover. The vulnerability has a CVSS score of 8.8 (High), indicating a network-based attack with low complexity, requiring user interaction, and leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, suggesting a high level of awareness.