CVE-2026-92116

Summary

Apache Allura's OAuth1 callback validation is vulnerable to URL redirection attacks, allowing attackers to redirect users to malicious sites during authentication flows. This critical flaw can lead to phishing attacks or credential theft.

Exploitability

Exploitation requires an attacker to craft a malicious OAuth1 callback URL and convince a victim to click it, with no additional preconditions needed for the vulnerability itself.

Blast radius

If exploited, this vulnerability could impact all users authenticating through OAuth1-enabled Allura instances, potentially affecting thousands of users across multiple projects and repositories.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Allura version 1.22.0 which fixes the OAuth1 callback validation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.