---
id: "CVE-2026-101274"
kind: "vulnerability"
aliases: ["CVE-2026-101274"]
title: "pretix: SSO client can receive id_token despite code-only configuration"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pretix", "self-hosted", "sso"]
not_affected_if: ["auth-required", "no-sso-idp"]
published_at: "2026-10-28T11:17:13+00:00"
first_seen_at: "2026-10-28T11:32:27+00:00"
updated_at: "2026-10-28T11:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101274", "first_seen_at": "2026-10-28T11:32:27+00:00"}]
---

# pretix: SSO client can receive id_token despite code-only configuration

pretix acting as an SSO identity provider did not check the requested response_type against the client's configured grant type. A client set up for code-only flow can be tricked into receiving an id_token instead, which the attacker can use without the client secret.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the pretix version installed with `pip show pretix`
- Review SSO client configuration for any client limited to the `code` response type
- unknown

## Fix

- Upgrade pretix to the patched release named in the NVD entry (version unknown from the sources)
- unknown

## Timeline

- 2026-10-28T11:32:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101274

## From the sources

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_