Live › vulnerability › CVE-2026-51954
Go to dashboardWebasyst Framework 4.0.3 and earlier mishandles OAuth authorization URLs that carry an arbitrary redirect_uri. A remote attacker can craft such a URL to execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Webasyst Framework 4.0.3 or earlier that expose its OAuth authorization flow to remote users are likely exposed. unknown whether OAuth must be actively configured for the flaw to be reachable. Teams on a later release or without Webasyst may skip it.
No product ranges from the sources yet.
4.0.3; versions at or below it are in scope per the NVD description4.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.
This page as .md · .json · in your agent: get_signal("CVE-2026-51954")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.