CVE-2026-92116

Received Received - Intake

OAuth1 Callback Validation Flaw in Apache Allura

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Apache Software Foundation

Description

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-92116

EUVD

EUVD-2026-97829

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Allura 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an OAuth1 callback validation flaw in Apache Allura versions up to 1.21.0. It allows unauthorized access or manipulation of callback URLs during authentication, potentially leading to account takeover or data exposure.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass authentication, gain unauthorized access to user accounts, or steal sensitive data stored in Apache Allura instances.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability relates to OAuth1 callback validation in Apache Allura, which may lead to unauthorized access but lacks details on regulatory implications.

Mitigation Strategies

Upgrade Apache Allura to version 1.22.0 or later to address the OAuth1 callback validation vulnerability.

Hi! I’m here to help you understand CVE-2026-92116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70