OAuth Vulnerability in Ditto Explorer by Eclipse

CVE-2026-107503

What is CVE-2026-107503?

A vulnerability exists in Ditto Explorer which allows attackers to exploit unvalidated environment URLs. By injecting a malicious OpenID Connect (OIDC) authority in crafted links, an attacker can initiate a session that captures users' OAuth authorization codes along with PKCE verifier values. When victims unwittingly log in via an attacker-controlled token endpoint, their access and refresh tokens can be compromised. Consequently, even subsequent visits to the UI without crafted links can lead to repeated token theft due to persisted configurations, facilitating account takeovers.

References