Open redirect in Apache Allura - CVE-2026-92116
Published: October 22, 2026
Vulnerability identifier: #VU157250
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92116
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect an OAuth1 authorization flow to an unvalidated destination, potentially exposing authorization data.
The vulnerability exists due to missing callback destination validation in the Apache Allura OAuth1 implementation when handling OAuth1 callbacks. A remote attacker can supply a crafted callback destination to potentially redirect authorization data to an attacker-controlled location.
Affected software
Apache Allura
How to mitigate CVE-2026-92116
Install security update from vendor's website.
Apache Allura - update to 1.22.0