Cross-Site Request Forgery Vulnerability in Hubzilla by Zotlabs

CVE-2026-70556

What is CVE-2026-70556?

Hubzilla version 11.2.1 has a significant vulnerability involving cross-site request forgery (CSRF) within the OAuth2 /authorize endpoint. This flaw enables unauthenticated attackers to exploit the system and register arbitrary OAuth2 applications under the account of authenticated users. Without necessary CSRF token verification or Origin/Referer checks, attackers can send malicious POST requests containing chosen OAuth2 parameters like client_id, client_secret, and redirect_uri. By leveraging this vulnerability, attackers can silently create persistent OAuth2 applications, allowing them to intercept authorization codes from users during subsequent authentications against the attacker-controlled client.

References