pretix up to 2026.6.3/2026.7.2/2026.8.0 SSO Client response_type improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in pretix up to 2026.6.3/2026.7.2/2026.8.0. The affected element is an unknown function of the component SSO Client. The manipulation of the argument response_type leads to improper authorization. This vulnerability is documented as CVE-2026-101274. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in pretix up to 2026.6.3/2026.7.2/2026.8.0. This issue affects some unknown functionality of the component SSO Client. The manipulation of the argument response_type with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.

The advisory is shared at pretix.eu. The identification of this vulnerability is CVE-2026-101274 since 09/28/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 2026.6.4, 2026.7.3 or 2026.8.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• pretix

Version

• 2026.0
• 2026.1
• 2026.2
• 2026.3
• 2026.4
• 2026.5
• 2026.6
• 2026.6.0
• 2026.6.1
• 2026.6.2
• 2026.6.3
• 2026.7
• 2026.7.0
• 2026.7.1
• 2026.7.2
• 2026.8.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion