Live › vulnerability › CVE-2026-111622
Go to dashboardsmart-sso through 2.1.1 does not validate the redirectUri parameter on its /login handler, so a crafted link sends a signed-in user's OAuth2 authorization code to an attacker-controlled site. The attacker can redeem that code at /oauth2/access_token with any valid client credentials and obtain the victim's access token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments that run smart-sso 2.1.1 or earlier as their OAuth2 or SSO login service and expose the /login endpoint to users. Users with active SSO sessions who click a crafted link are the victims. Teams not running smart-sso can skip it.
No product ranges from the sources yet.
2.1.1 are affected2.1.1; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-111622")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.