Appsmith Mismatched Origin Reset

Tim Peck@timpeck

•updated Jan 22, 2026•1•0•25

Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.