HMAC Validation Bypass in Thumbor Open-Source Image Service by Globo.com

CVE-2026-53501

What is CVE-2026-53501?

The HMAC validation mechanism in Thumbor, an open-source photo thumbnail service developed by Globo.com, is vulnerable to bypassing prior to version 7.8.0. This vulnerability arises from the inappropriate use of Python's .replace() method, which removes all occurrences of a specific substring when processing URLs. An attacker could exploit this flaw by inserting the same signature multiple times in a URL, creating a situation where the validated string does not match the actual requested resource. Consequently, this allows malicious actors to load images from unauthorized domains or paths, posing significant security risks for users of the service. The issue has been addressed in the 7.8.0 release.

References