{"id":"CVE-2026-92116","published":"2026-10-12T21:17:23.240","lastModified":"2026-10-16T18:19:43.327","description":"OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-601"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/d716zfvgpnrjlsc7bmysv4sxbnh2b57f","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/12/3","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Allura's OAuth1 callback validation is vulnerable to URL redirection attacks, allowing attackers to redirect users to malicious sites during authentication flows. This critical flaw can lead to phishing attacks or credential theft.","exploitability":"Exploitation requires an attacker to craft a malicious OAuth1 callback URL and convince a victim to click it, with no additional preconditions needed for the vulnerability itself.","blast_radius":"If exploited, this vulnerability could impact all users authenticating through OAuth1-enabled Allura instances, potentially affecting thousands of users across multiple projects and repositories.","remediation":"Upgrade to Apache Allura version 1.22.0 which fixes the OAuth1 callback validation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["oauth","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:48:33.190Z"}}