CVE-2026-92120: Apache Allura: Oauth1 Replay Attack
Apache Allura is affected by a low-severity OAuth1 replay attack tracked as CVE-2026-92120.
16
Vulnerability1 · 1 read
CVE-2026-92120
OAuth1 request replay in Apache Allura
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Allura through version 1.21.0 is affected by an OAuth1 request replay vulnerability (CWE-294, authentication bypass by capture-replay). An attacker who obtains a legitimate OAuth1-signed request can submit that same request again and have it accepted, because affected versions do not adequately prevent reuse. That can let the attacker repeat actions the original requester was authorized to perform. Operators of self-hosted Allura forges and other sites running versions through 1.21.0 are affected; version 1.22.0 is the stated fix. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.
What to do: Upgrade Apache Allura to 1.22.0, which the project states fixes this OAuth1 replay issue. Until that upgrade is in place, limit network access to Allura’s OAuth endpoints and review logs for repeated identical signed requests.
| Product | Affected |
|---|---|
| Apache Allura | through 1.21.0 |
Estimated exposure
nicheon the order of hundreds of deployments; exact count unknown — Apache Allura is a specialized open-source software forge (best known as the platform behind SourceForge) with a limited set of self-hosted deployments; the advisory data contains no active-install or internet-scan counts.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.
- Weakness
- CWE-294
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N