CVE-2026-70556 in Hubzilla
Summary
by MITRE • 08/06/2026
Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
This cross-site request forgery vulnerability in Hubzilla 11.2.1 represents a critical security flaw that undermines the integrity of the OAuth2 authentication framework. The vulnerability exists within the Zotlabs\Module\Authorize::post() method which processes OAuth2 authorization requests without proper validation mechanisms. The absence of CSRF token verification and origin/referer checks creates an exploitable condition where attackers can manipulate the OAuth2 registration process through malicious cross-origin requests.
The technical implementation flaw stems from the lack of request validation controls that should normally prevent unauthorized modifications to user accounts. According to CWE-352, this constitutes a classic cross-site request forgery vulnerability where legitimate users are tricked into performing actions they did not intend. The vulnerability allows attackers to submit arbitrary OAuth2 application parameters including client_id, client_secret, redirect_uri, and scope through automated form submissions. This represents a failure in input validation and session management practices that should be enforced at the application layer.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass persistent surveillance capabilities. Once an attacker successfully registers an OAuth2 application under a victim's account, they can intercept future authorization codes when the victim authenticates against the attacker-controlled client. This creates a persistent threat vector where attackers can maintain access to user sessions and potentially escalate privileges through repeated exploitation. The vulnerability affects the fundamental trust model of the OAuth2 protocol by allowing unauthorized third parties to register applications that can masquerade as legitimate services.
Security professionals should implement comprehensive mitigations including mandatory CSRF token validation for all state-changing operations, strict origin header verification, and referer checking mechanisms. The ATT&CK framework categorizes this vulnerability under T1548.002 for abuse of OAuth2 protocols and T1566 for social engineering techniques that leverage CSRF vulnerabilities. Organizations should enforce proper session management controls, implement rate limiting on OAuth2 registration endpoints, and consider additional authentication factors such as two-factor authentication to prevent unauthorized application registration. Regular security audits should validate that all OAuth2 endpoints properly validate request origins and implement appropriate anti-CSRF protection mechanisms.
This vulnerability demonstrates the critical importance of validating all incoming requests through proper origin checking and token validation rather than relying on implicit trust in the user's authenticated session state. The attack vector represents a sophisticated social engineering technique where attackers can silently register persistent applications that remain active until manually removed by the legitimate user or administrator. The long-term implications include potential data exfiltration, session hijacking, and unauthorized access to user resources through the compromised OAuth2 application registration process.