CVE-2026-92120

9.1Critical

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.1Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-294

Impact

Remote, unauthenticated attackers can replay captured OAuth 1.0 requests to access unauthorized data and perform actions with the victim's privileges. They only need network-level visibility or access to intercept legitimate OAuth traffic.

Root cause

The application fails to properly validate OAuth 1.0 request nonces or timestamps, permitting intercepted requests to be replayed.

Affected systems

Apache Allura through 1.21.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade Apache Allura to version 1.22.0 or later. No interim mitigation is provided in the advisory.

shell

$ pip install --upgrade 'Allura>=1.22.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-92120