Three Apache Allura flaws disclosed on oss-security
First coverage.
Apache Allura has three newly disclosed flaws: important OAuth1 callback validation, moderate REST mass assignment, and a low-severity OAuth1 replay.
On 2026-10-12, Dave Brondsema posted three oss-security notices covering separate Apache Allura vulnerabilities. CVE-2026-92116 is missing OAuth1 callback validation and is rated important. CVE-2026-92119 is a REST API mass-assignment issue rated moderate. CVE-2026-92120 is an OAuth1 replay attack rated low. Each notice links to the Allura project and the corresponding CVE record. The sources agree that no affected versions, remediation, or observed attacks are described.
- Dave Brondsema disclosed three Apache Allura vulnerabilities on oss-security on 2026-10-12.
- CVE-2026-92116 is missing OAuth1 callback validation, rated important by Apache.
- CVE-2026-92119 is a REST API mass-assignment flaw, rated moderate.
- CVE-2026-92120 is an OAuth1 replay attack, rated low.
- None of the notices list affected versions, a patch, or evidence of exploitation.
- Vendors
- Apache
- Products
- Apache Allura
- Organizations
- Apache Software Foundation
Coverage
oldest first · one row per article · UTC- · 18d ago
oss-securityFirst report
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation
Apache Allura OAuth1 callback validation flaw CVE-2026-92116 is rated important.
- · 18d ago
CVE-2026-92119: Apache Allura: REST API Mass Assignment
Apache Allura has a moderate-severity REST API mass-assignment flaw, CVE-2026-92119.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-92116+2 related CVEs | OAuth1 callback validation flaw in Apache Allura | 9.1 | — |