Apache Allura OAuth1 rebinding vulnerability disclosed (CVE-2026-118196)
Apache Allura rebinding issue rated critical; details at allura.apache.org.
40
CVE-2026-118196
OAuth 1 rebinding in Apache Allura before 1.22.1
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
OAuth 1 rebinding vulnerability affects Apache Allura through version 1.22.0. Attackers can exploit this flaw to rebind OAuth 1 tokens. Users of Apache Allura versions 1.22.0 and earlier are affected.
What to do: Upgrade Apache Allura to 1.22.1.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Allura | through 1.22.0 | 1.22.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
- Weakness
- CWE-863