CVE-2026-118196

Description

OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.

References

https://lists.apache.org/thread.html/2x7c9741d50xw3o10h92rk19cr55trof

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119928

http://www.openwall.com/lists/oss-security/2026/11/07/1

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS