CVE-2026-118196 · Other
NO FIX YET · SEE WHAT TO DO
Apache Allura, a software forge platform, has an OAuth 1 rebinding vulnerability in versions through 1.22.0. The sources do not describe what an attacker can read or change once the flaw is used.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Installations of Apache Allura through version 1.22.0 are affected. The sources do not say which deployment setups or OAuth configurations are exposed.
Not affected if version-1.22.1-or-later
Who cares apache-allura, self-hosted
1.22.0 or earlier.1.22.1.OAuth 1 rebinding vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.22.0.
Users are recommended to upgrade to version 1.22.1, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.