CVE-2026-107503

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopts this configuration without user confirmation and persists it in the browser's localStorage. A crafted link can therefore set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft. In versions 3.9.0 to 3.9.7, the Swagger UI OIDC integration of the Helm chart and the Docker Compose deployment is affected in the same way, but requires the user to start the login. The issue is fixed in 3.8.14 and 3.9.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107503

EUVD

EUVD-2026-94823

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Ditto	Ditto Explorer UI 3.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

This vulnerability in Eclipse Ditto Ditto Explorer allows attackers to steal OAuth authorization codes and PKCE verifiers by injecting a malicious OIDC authority link. The UI automatically starts a login at the genuine provider but exchanges tokens with the attacker's endpoint, enabling account takeover. Attackers can also steal bearer tokens or Basic credentials by manipulating the api_uri.

Detection Guidance

Check for unauthorized OIDC authority configurations in Ditto Explorer UI settings. Inspect network traffic for unexpected token exchanges to unknown endpoints. Look for persistent configurations that redirect to attacker-controlled domains.

Impact Analysis

An attacker could gain full access to your account, steal sensitive data, or perform actions on your behalf. If credentials are stolen, they may access other systems using the same credentials. The attack persists even after the crafted link is removed due to configuration persistence.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Ditto Explorer to a version outside the vulnerable range [3.6.0,3.9.7] to prevent OIDC authority injection and token theft. Disable autoSso if not required and avoid clicking untrusted links that may set attacker-controlled environments URL.

Hi! I’m here to help you understand CVE-2026-107503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70