Live › vulnerability › CVE-2026-117553
Go to dashboardUmbraco CMS before 17.7.2 and 18.2.2 trusts the Host header when registering OAuth redirect URIs, so an unauthenticated attacker can register their own redirect URI. Attackers send signed-in editors authorization links using response_mode=form_post to capture codes, then redeem them to take over back-office sessions and run code through Razor templates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Sites running Umbraco CMS with the back-office exposed to the internet are the main concern, since the attack starts with a request to the public site and relies on a signed-in editor clicking a link. The sources do not say whether non-default OAuth or external login configurations are required, so teams on older 17.x or 18.x releases should treat themselves as affected until upgraded.
No product ranges from the sources yet.
17.7.2 on the 17 line or below 18.2.2 on the 18 line are affected.17.7.2 or later on the 17 line, or 18.2.2 or later on the 18 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
This page as .md · .json · in your agent: get_signal("CVE-2026-117553")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.