Cross-Site Request Forgery in Hubzilla OAuth2 Authorization

Executive Summary

CVE-2026-70556 is a cross-site request forgery (CSRF) vulnerability in Hubzilla 11.2.1. It affects the OAuth2 /authorize endpoint in the Zotlabs\Module\Authorize::post() function. An unauthenticated attacker can exploit this by sending a cross-origin POST request without proper CSRF token or Origin/Referer validation to register arbitrary OAuth2 applications under an authenticated user's account.

Useful 0 Not Useful 0

Detection Guidance

To detect this CSRF vulnerability in Hubzilla's OAuth2 /authorize endpoint, monitor for unauthorized OAuth2 application registrations under user accounts. Check server logs for POST requests to /authorize without valid CSRF tokens or Origin/Referer headers. Inspect network traffic for cross-origin POST requests with attacker-controlled parameters like client_id or redirect_uri.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to register malicious OAuth2 applications under your account. Once registered, these applications can intercept future OAuth2 authorization codes when you authenticate, enabling persistent access and potential further exploitation of your account.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Hubzilla to the patched version. If unable to update, disable OAuth2 application registration until patched. Implement strict CSRF token validation and Origin/Referer header checks on the /authorize endpoint. Review recently registered OAuth2 applications for suspicious entries.

Useful 0 Not Useful 0