CVE-2026-117553
CVE-2026-117553 · Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
CVSS 7.7 · Alta · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
umbraco-cms
- Versiones
- ≥ 0, < 17.7.2: Afectada (semver)
- ≥ 18.0.0, < 18.2.2: Afectada (semver)
Actualiza a 17.7.2; Actualiza a 18.2.2
Fuentes originales
- https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6
- https://github.com/umbraco/Umbraco-CMS
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469
- https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112
- https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-account-takeover-via-host-header-poisoning
- https://nvd.nist.gov/vuln/detail/CVE-2026-117553