{"id":"CVE-2026-111622","kind":"vulnerability","aliases":["CVE-2026-111622"],"related":[],"title":"smart-sso: open redirect in /login leaks OAuth2 authorization codes","description":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.","summary":"smart-sso through 2.1.1 does not validate the redirectUri parameter on its /login handler, so a crafted link sends a signed-in user's OAuth2 authorization code to an attacker-controlled site. The attacker can redeem that code at /oauth2/access_token with any valid client credentials and obtain the victim's access token.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oauth2","package","self-hosted","smart-sso","sso"],"not_affected_if":["smart-sso-not-used"],"how_to_check":"- Check the installed smart-sso version in the project's package manifest or lockfile; versions through `2.1.1` are affected\n- Review the /login handler for use of the redirectUri parameter without an allow-list check\n- unknown","fix":"- Upgrade smart-sso to a version later than `2.1.1`; the fixed version is unknown from the sources\n- Until a fix is available, validate redirectUri against a fixed allow-list of registered callback URLs\n- unknown","status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:14:41+00:00","updated_at":"2026-10-25T03:14:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:14:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade smart-sso to a version later than `2.1.1`; the fixed version is unknown from the sources\n- Until a fix is available, validate redirectUri against a fixed allow-list of registered callback URLs\n- unknown","reach":"internet","title":"smart-sso: open redirect in /login leaks OAuth2 authorization codes","impact":"high","summary":"smart-sso through 2.1.1 does not validate the redirectUri parameter on its /login handler, so a crafted link sends a signed-in user's OAuth2 authorization code to an attacker-controlled site. The attacker can redeem that code at /oauth2/access_token with any valid client credentials and obtain the victim's access token.","category":"package","nicknames":[],"who_cares":["smart-sso","oauth2","sso","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker takes victims' OAuth2 access tokens via redirected authorization codes","analyst_note":"Confirm the fixed smart-sso version and the exact redirectUri check from the NVD entry or the project's repository.","how_to_check":"- Check the installed smart-sso version in the project's package manifest or lockfile; versions through `2.1.1` are affected\n- Review the /login handler for use of the redirectUri parameter without an allow-list check\n- unknown","needs_analyst":true,"not_affected_if":["smart-sso-not-used"],"who_is_affected":"Deployments that run smart-sso 2.1.1 or earlier as their OAuth2 or SSO login service and expose the /login endpoint to users. Users with active SSO sessions who click a crafted link are the victims. Teams not running smart-sso can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3358,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111622':14A,17A '-2026':13A,16A '/login':7A,40B,94C,115C '/oauth2/access_token':69B,128C '2.1.1':31B,86C 'access':80B,137C 'activ':120C 'allow':97C 'attack':59B,63B,99C,111C 'attacker-control':58B 'author':10A,54B,103C 'client':73B,132C 'code':11A,55B,67B,104C,126C 'contain':87C 'control':60B 'craft':44B,114C 'credenti':74B,133C 'cve':12A,15A 'handler':41B,95C 'host':22B 'leak':8A 'link':45B,116C 'oauth2':9A,18B,53B,102C 'obtain':76B,135C 'open':4A,89C 'packag':19B 'paramet':37B,110C 'redeem':65B,124C 'redirect':5A,90C 'redirecturi':36B,109C 'self':21B 'self-host':20B 'send':46B,113C 'session':122C 'sign':49B 'signed-in':48B 'site':61B 'smart':2A,24B,28B,83C 'smart-sso':1A,23B,27B,82C 'sso':3A,25B,26B,29B,84C,121C 'steal':101C 'stolen':125C 'suppli':106C 'token':81B,138C 'unauthent':98C 'unvalid':108C 'user':51B,118C 'valid':34B,72B,131C 'victim':78B,136C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Deployments that run smart-sso 2.1.1 or earlier as their OAuth2 or SSO login service and expose the /login endpoint to users. Users with active SSO sessions who click a crafted link are the victims. Teams not running smart-sso can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111622","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-16T20:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}