CVE-2026-117553
7.5 HIGHpublic exploit availablePublished 2026-10-27 · Updated 2026-10-27
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-601
Public exploit & PoC references
- https://github.com/umbraco/Umbraco-CMS
- https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112
- https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469
All references
- https://github.com/umbraco/Umbraco-CMS
- https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112
- https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469
- https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-account-takeover-via-host-header-poisoning
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-4989PoC
- MEDIUMCVE-2024-58389PoC
- MEDIUMCVE-2024-58398PoC
- MEDIUMCVE-2026-100523PoC
- CRITICALCVE-2026-101090PoC
- MEDIUMCVE-2026-101151
- HIGHCVE-2026-101152
- MEDIUMCVE-2026-101403
Related by shared AI tags and CWE weakness class. Browse the full archive.