{"id":"CVE-2026-92120","published":"2026-10-12T21:17:23.490","lastModified":"2026-10-16T18:19:43.650","description":"OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-294"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/xpo1wbh1m18tvn9ow3h599wgcswbvn5x","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/12/5","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Allura's OAuth1 implementation is vulnerable to request replay attacks, allowing attackers to reuse valid OAuth requests and potentially gain unauthorized access to user accounts or perform actions on their behalf. This critical vulnerability can lead to significant data exposure and privilege escalation.","exploitability":"Exploitation requires intercepting a valid OAuth1 request and replaying it within the token expiration window, making it moderately difficult but possible with network interception capabilities.","blast_radius":"If exploited, this vulnerability could allow attackers to access user accounts, perform unauthorized actions, and potentially escalate privileges across the affected Allura instance.","remediation":"Upgrade to Apache Allura version 1.22.0 which fixes the OAuth1 replay attack vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["oauth","authentication","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:48:44.957Z"}}