CVE-2026-92116

Apache Allura through 1.21.0 has an OAuth1 callback validation flaw classified as CWE-601 (URL redirection to an untrusted site). The issue is triggered when an OAuth1 callback URL is not properly checked, so a crafted callback can send the user or the authorization response to an attacker-controlled location. That redirection can expose OAuth authorization material and support phishing or abuse of the OAuth1 flow on sites that use it. Anyone running Apache Allura through 1.21.0 is affected; version 1.22.0 is the recommended fix. There is no known public proof of concept, the CVE is not in the CISA KEV catalog, and CVSS has not yet been scored.

What to do: Upgrade Apache Allura to 1.22.0, which the vendor states fixes the OAuth1 callback validation issue. Until that upgrade is in place, review OAuth1 consumers and reject or tightly allow-list callback URLs rather than accepting caller-supplied ones. No public proof of concept is known and the CVE is not in CISA KEV, but unpatched instances should still be treated as exposed.