CVE-2026-117553 in Umbraco
Summary
by MITRE • 10/27/2026
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Umbraco CMS versions prior to 17.7.2 and 18.2.2 represents a critical authentication bypass mechanism rooted in improper validation of the Host header during OAuth authorization flows. This flaw allows unauthenticated attackers to manipulate the redirect URI used by the identity provider, effectively poisoning the callback endpoint with attacker-controlled domains. By exploiting this misconfiguration, an adversary can intercept sensitive authorization codes intended for legitimate applications, thereby gaining unauthorized access to user sessions and potentially executing arbitrary code within the CMS environment.
The technical mechanism of exploitation begins when a victim, who is already authenticated or being prompted to authenticate, clicks on a maliciously crafted link containing an OAuth authorization request. The attacker constructs this request with specific parameters that leverage the response_mode=form_post setting. This mode ensures that the identity provider submits the authorization code directly via an HTTP POST request rather than appending it as a query parameter in the URL redirect. Because Umbraco fails to strictly validate the Host header against a whitelist of allowed origins, the application accepts redirects from domains controlled by the attacker. Consequently, when the user authenticates, the authorization code is sent to the attacker's server instead of the legitimate callback endpoint registered with the CMS.
Once the attacker captures the valid OAuth authorization code through this poisoned redirect mechanism, they proceed to redeem it using HTTP Basic authentication credentials associated with their malicious client application. This step allows the attacker to exchange the intercepted code for access tokens and refresh tokens without possessing the actual user's password or multi-factor authentication factors. The successful redemption of these tokens grants the attacker a valid session within the Umbraco back-office interface, effectively bypassing standard authentication controls. This unauthorized access is not limited to mere data exfiltration; it provides full administrative privileges depending on the victim's role, enabling deep integration into the system's core functionalities.
The operational impact of this vulnerability extends beyond simple account takeover due to the specific capabilities available within Umbraco’s back-office environment. With elevated session control, an attacker can manipulate Razor templates, which are server-side view engines used for rendering dynamic content in .NET applications. By injecting malicious code into these templates, the adversary achieves remote code execution on the underlying web server. This capability transforms a standard authentication bypass into a severe compromise of system integrity and confidentiality, allowing for data theft, defacement, or further lateral movement within the network infrastructure hosting the CMS.
From an industry standards perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically involving the failure to validate identity providers in OAuth flows. It also relates closely to CWE-601, URL Redirection to Untrusted Site (Open Redirect), as the core issue stems from accepting unvalidated redirect targets. In terms of tactical classification under MITRE ATT&CK, this exploit maps directly to T1528 Steal Application Access Tokens and T1190 Exploit Public-Facing Application. The use of form_post for code delivery is a sophisticated technique often employed in advanced phishing campaigns or targeted attacks where stealth and reliability are prioritized over brute-force methods.
Mitigation strategies must focus on immediate patching to the latest secure versions, specifically Umbraco 17.7.2 or later and version 18.2.2 or higher, which address these validation gaps. For organizations unable to upgrade immediately, implementing strict Host header validation at the reverse proxy or web server level can provide a temporary buffer against such attacks. Additionally, enforcing Content Security Policy headers that restrict form submissions and monitoring for unusual OAuth token redemption patterns can aid in early detection. Administrators should also review registered OAuth clients to ensure only trusted domains are permitted as redirect URIs, thereby reducing the attack surface available to potential adversaries attempting header poisoning techniques.