CVE-2026-117553 in Umbraco
요약
\~에 의해 MITRE • 2026. 10. 27.
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.