CVE-2026-107503
Received Received - Intake

OAuth Authorization Code Theft in Eclipse Ditto Explorer

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Eclipse Foundation

Description
Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107503
EUVD
EUVD-2026-94823

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Ditto Ditto Explorer UI 3.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-346 The product does not properly verify that the source of data or communication is valid.
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Eclipse Ditto Ditto Explorer allows attackers to steal OAuth authorization codes and PKCE verifiers by injecting a malicious OIDC authority link. The UI automatically starts a login at the genuine provider but exchanges tokens with the attacker's endpoint, enabling account takeover. Attackers can also steal bearer tokens or Basic credentials by manipulating the api_uri.

Detection Guidance

Check for unauthorized OIDC authority configurations in Ditto Explorer UI settings. Inspect network traffic for unexpected token exchanges to unknown endpoints. Look for persistent configurations that redirect to attacker-controlled domains.

Impact Analysis

An attacker could gain full access to your account, steal sensitive data, or perform actions on your behalf. If credentials are stolen, they may access other systems using the same credentials. The attack persists even after the crafted link is removed due to configuration persistence.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Ditto Explorer to a version outside the vulnerable range [3.6.0,3.9.7] to prevent OIDC authority injection and token theft. Disable autoSso if not required and avoid clicking untrusted links that may set attacker-controlled environments URL.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart