Authentication Bypass in Umbraco CMS Affects Multiple Versions
CVE-2026-117553
7.7HIGH
What is CVE-2026-117553?
Umbraco CMS versions prior to 17.7.2 and 18.2.2 are affected by an authentication bypass vulnerability. This flaw allows unauthenticated attackers to exploit the Host header to register malicious OAuth redirect URIs. By leveraging response_mode=form_post, attackers can send authorization links to authenticated users. When users engage with these links, attackers can capture authorization codes and subsequently redeem them using HTTP Basic client credentials. This process enables the hijacking of back-office sessions and the execution of arbitrary code via Razor templates, posing significant security risks.
Affected Version(s)
Umbraco-CMS 0 < 17.7.2
Umbraco-CMS 18.0.0 < 18.2.2
References
CVSS V4
Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Eu Joe Chegne (Project Umbra)
Damien Wong (Project Umbra)
AndyButland