Apache Allura: OAuth1 request replay attack

Summary

Apache Allura, an open source software forge, contains a replay weakness in its OAuth1 request handling (CWE-294). An attacker who can capture a valid OAuth1-signed request may be able to replay it to gain unauthorised access, with possible impact on confidentiality and integrity. The CVSS score of 9.1 published in the CVE data conflicts with the vendor's rating of low, and NVD analysis is still deferred.

Affected

• Apache Allura through 1.21.0

Fixed in

• Apache Allura 1.22.0

Workaround

Unknown. No vendor-approved interim mitigation is documented.

Exploitation

• No known exploitation found.
• No public proof of concept found; this is not a confirmed absence.
• EPSS 0.0015 (very low predicted exploitation probability).
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.

Our recommendation

• Inventory all Allura installations and their versions.
• Upgrade anything at 1.21.0 or earlier to 1.22.0.
• Review OAuth1 app registrations and callback URLs.
• Limit external access to OAuth1 endpoints and monitor for unusual API activity until patched.
• Treat as high priority until the scoring is settled; do not rely on the vendor's low rating alone.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache Allura 1.22.0 release notes allura.apache.org
• Apache mailing list thread lists.apache.org
• oss-security post CVE-2026-92120 www.openwall.com
• OpenCVE CVE-2026-92120 app.opencve.io
• Rapid7 via Vulners CVE-2026-92120 vulners.com
• Positive Technologies PT-2026-110913 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:52.