{"id":"CVE-2026-101274","kind":"vulnerability","aliases":["CVE-2026-101274"],"related":[],"title":"pretix: SSO client can receive id_token despite code-only configuration","description":"When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.","summary":"pretix acting as an SSO identity provider did not check the requested response_type against the client's configured grant type. A client set up for code-only flow can be tricked into receiving an id_token instead, which the attacker can use without the client secret.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pretix","self-hosted","sso"],"not_affected_if":["auth-required","no-sso-idp"],"how_to_check":"- Check the pretix version installed with `pip show pretix`\n- Review SSO client configuration for any client limited to the `code` response type\n- unknown","fix":"- Upgrade pretix to the patched release named in the NVD entry (version unknown from the sources)\n- unknown","status":"open","published_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:28+00:00","updated_at":"2026-10-28T11:33:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:33:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pretix to the patched release named in the NVD entry (version unknown from the sources)\n- unknown","reach":"internet","title":"pretix: SSO client can receive id_token despite code-only configuration","impact":"medium","summary":"pretix acting as an SSO identity provider did not check the requested response_type against the client's configured grant type. A client set up for code-only flow can be tricked into receiving an id_token instead, which the attacker can use without the client secret.","category":"package","nicknames":[],"who_cares":["pretix","self-hosted","sso"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker obtains a valid id_token for a client's customer account","analyst_note":"Patched version and fixed release not given in sources; check the NVD entry and pretix release notes for the fix version.","how_to_check":"- Check the pretix version installed with `pip show pretix`\n- Review SSO client configuration for any client limited to the `code` response type\n- unknown","needs_analyst":true,"not_affected_if":["no-sso-idp","auth-required"],"who_is_affected":"Only sites running pretix as the identity provider for customer-account single sign-on, where an SSO client is configured with a redirect_uri list. Exploitation also requires the attacker to run JavaScript on a page at one of those allowed redirect_uri targets. Sites that do not use pretix as an SSO identity provider are not exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3406,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101274':15A,18A '-2026':14A,17A 'account':91C 'act':26B 'allow':126C 'attack':66B,161C 'author':104C 'back':153C 'check':34B 'client':3A,41B,47B,71B,114C,121C,136C,181C 'code':10A,52B,128C 'code-on':9A,51B 'configur':12A,43B,108C,123C,182C 'custom':90C 'cve':13A,16A 'despit':8A 'exploit':157C 'flow':54B 'grant':44B,109C 'host':23B 'id':6A,61B,148C 'ident':30B,79C 'instead':63B 'javascript':164C 'knowledg':133C 'like':147C 'list':177C 'mean':116C 'must':173C 'packag':19B 'page':167C 'pretix':1A,20B,25B,74C 'proper':96C 'provid':31B,80C 'receiv':5A,59B,152C 'redirect':170C 'request':36B,101C,105C 'requir':132C,159C 'respons':37B,99C,129C,145C 'run':163C 'secret':72B,137C 'self':22B 'self-host':21B 'send':143C 'set':48B 'setup':88C 'sign':85C 'singl':84C 'single-sign-on':83C 'specifi':168C,178C 'sso':2A,24B,29B,87C,113C,120C 'system':93C 'token':7A,62B,149C,156C 'trick':57B 'type':38B,45B,100C,110C,130C,146C 'uri':171C 'use':68B,76C,139C 'valid':97C,155C 'without':69B 'would':141C,151C 'wrong':142C","nicknames":[],"mitigations":[],"who_affected":"Only sites running pretix as the identity provider for customer-account single sign-on, where an SSO client is configured with a redirect_uri list. Exploitation also requires the attacker to run JavaScript on a page at one of those allowed redirect_uri targets. Sites that do not use pretix as an SSO identity provider are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"655498c3-6ec5-4f0b-aea6-853b334d05a6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101274","severity":null,"published_at":"2026-10-28T11:17:13+00:00","modified_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}