OAuth Vulnerability in Plane Project Management Tool by MakePlane

CVE-2026-105628

What is CVE-2026-105628?

Prior to version 1.4.0, Plane, an open-source project management tool, has a vulnerability in its OAuth avatar synchronization flow. This occurs when the tool fetches avatar URLs from provider user data through server-side HTTP requests without proper internal IP validation and unwarranted following of redirects. An attacker can exploit this by providing a malicious avatar URL that redirects to an internal-only resource, like a metadata endpoint. Consequently, Plane uploads the fetched response as a user avatar file, which can lead to unintentional exposure of internally fetched content through the /api/assets/v2/static/{asset_id}/ endpoint. The issue has been addressed in version 1.4.0.

References