CVE-2026-49254
Received Received - Intake

Dragonfly OAuth Client Secret Exposure Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-49254
EUVD
EUVD-2026-78577

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dragonfly dragonfly to 2.4.4 (inc)
dragonflyoss dragonfly 2.4.4
dragonflyoss dragonfly to 2.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dragonfly is a P2P file distribution system. This vulnerability involves unauthenticated access to OAuth client secrets via unprotected API endpoints. Attackers can retrieve sensitive OAuth provider credentials (client secret, identifier, redirect URL) by accessing /api/v1/oauth or /api/v1/oauth/:id without authentication. The issue occurs because these GET endpoints lack JWT and RBAC middleware protection while other endpoints are secured.

Detection Guidance

Check for unauthorized access to /api/v1/oauth or /api/v1/oauth/:id endpoints by reviewing web server or application logs for GET requests to these paths. Use tools like curl to test if these endpoints return sensitive OAuth client secrets without authentication. Example: curl -v http://<target>/api/v1/oauth or curl -v http://<target>/api/v1/oauth/1

Impact Analysis

An attacker could use the exposed OAuth client secret to impersonate the Dragonfly Manager during OAuth handshakes, mint tokens, or craft phishing pages. This could lead to unauthorized access to protected resources or user accounts if the OAuth provider's redirect URI restrictions are bypassed. The practical impact is limited since Dragonfly itself does not use the OAuth feature.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of authentication credentials and sensitive data. Exposure of OAuth client secrets may constitute a breach of confidentiality obligations under GDPR (Article 32) and HIPAA (Safeguards Rule). Organizations using Dragonfly with OAuth providers must assess potential regulatory impacts and remediate the issue to maintain compliance.

Mitigation Strategies

Upgrade Dragonfly to version 2.4.4 or later to apply the fix. Ensure JWT and RBAC middleware protect all OAuth endpoints. Review and rotate exposed OAuth client secrets if they were accessed by unauthorized parties.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart