Apache Allura: Missing OAuth1 callback validation enables open redirect
Summary
Apache Allura through 1.21.0 does not properly validate OAuth1 callback URLs (CWE-601). An attacker can abuse this to redirect users to untrusted sites, which makes phishing via a trusted domain the main concern. The attack needs a crafted OAuth flow or link, and the CISA SSVC assessment shows no exploitation. The published CVSS score of 9.1 is disputed across sources, so prioritise by exposure.
Affected
- Apache Allura through 1.21.0
Fixed in
- Apache Allura 1.22.0 (fixes CVE-2026-92116, CVE-2026-92120 and CVE-2026-92119)
Workaround
- No vendor-published workaround. Apache recommends upgrading.
- Until patched, review registered OAuth1 applications and their callback URLs, and restrict callbacks to known, trusted domains.
Exploitation
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- No evidence of active exploitation found. No public proof-of-concept found (low-confidence aggregator sources).
Our recommendation
- Identify all Allura instances and their versions, and check for versions 1.21.0 or earlier.
- Upgrade to Allura 1.22.0.
- After upgrading, ask OAuth1 application owners to register exact https callback URLs, because older applications accept any callback until edited.
- Check the vendor advisory and NVD for updates, as the NVD status is currently Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Allura 1.22.0 release post allura.apache.org
- Apache mailing list thread lists.apache.org
- oss-security post CVE-2026-92116 www.openwall.com
- OpenCVE CVE-2026-92116 app.opencve.io
- Rapid7 listing on Vulners vulners.com
- Mend listing on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:51.
Original description (NVD)
OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.