{"id":"CVE-2026-51954","published":"2026-10-22T16:17:36.180","lastModified":"2026-10-22T17:40:46.877","description":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/Envincion/CVE-2026-51954","tags":[]},{"url":"https://github.com/webasyst/webasyst-framework/issues/389","tags":[]},{"url":"https://support.webasyst.com/forum/48658/unvalidated-redirect_uri-in-oauth-authorization-flow-allows-authorization-code-interception-and-permanent-api-access/","tags":[]}],"exploitRefs":[{"url":"https://github.com/Envincion/CVE-2026-51954","tags":[]},{"url":"https://github.com/webasyst/webasyst-framework/issues/389","tags":[]}],"hasPoc":true,"ai":null}