OAuth Token Disclosure in DocsGPT Affects Multiple User Accounts

CVE-2026-91201

What is CVE-2026-91201?

The DocsGPT application, up to version 0.20.0, exhibits a vulnerability in its OAuth connector that allows session tokens to be posted to a wildcard target origin without validating the sender's origin. This oversight can be exploited by malicious actors who utilize the window.opener object during OAuth authorization. By doing so, they can extract sensitive information such as session tokens and associated provider account emails, potentially enabling them to disconnect victims' cloud storage connectors and gain unauthorized access to user data.

References