{"id":"CVE-2026-51954","kind":"vulnerability","aliases":["CVE-2026-51954"],"related":[],"title":"Webasyst Framework: crafted OAuth redirect_uri lets remote attacker run code","description":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","summary":"Webasyst Framework 4.0.3 and earlier mishandles OAuth authorization URLs that carry an arbitrary redirect_uri. A remote attacker can craft such a URL to execute arbitrary code on the server.","severity":"unknown","cvss":null,"epss":0.00511,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","webasyst"],"not_affected_if":["newer-version"],"how_to_check":"- Check the installed Webasyst Framework version against `4.0.3`; versions at or below it are in scope per the NVD description\n- unknown whether the OAuth endpoint is enabled by default","fix":"- unknown; the sources do not name a fixed version. Check the Webasyst vendor release notes for a version later than `4.0.3`","status":"open","published_at":"2026-10-22T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T05:00:26+00:00","updated_at":"2026-10-25T05:00:26+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:00:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not name a fixed version. Check the Webasyst vendor release notes for a version later than `4.0.3`","reach":"internet","title":"Webasyst Framework: crafted OAuth redirect_uri lets remote attacker run code","impact":"high","summary":"Webasyst Framework 4.0.3 and earlier mishandles OAuth authorization URLs that carry an arbitrary redirect_uri. A remote attacker can craft such a URL to execute arbitrary code on the server.","category":"runtime","nicknames":[],"who_cares":["webasyst","self-hosted","php"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker executes arbitrary code on the server","analyst_note":"Confirm the affected version range, the fixed release and whether OAuth must be enabled, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-51954.","how_to_check":"- Check the installed Webasyst Framework version against `4.0.3`; versions at or below it are in scope per the NVD description\n- unknown whether the OAuth endpoint is enabled by default","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Sites running Webasyst Framework 4.0.3 or earlier that expose its OAuth authorization flow to remote users are likely exposed. unknown whether OAuth must be actively configured for the flaw to be reachable. Teams on a later release or without Webasyst may skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3322,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-51954':14A,17A '4.0.3':26B,59C 'allow':62C 'arbitrari':36B,49B,68C,78C 'attack':9A,41B,65C 'author':31B,74C 'carri':34B 'code':11A,50B,69C 'craft':3A,43B,72C 'cve':12A,15A 'earlier':28B 'execut':48B,67C 'framework':2A,25B,58C 'host':22B 'issu':55C 'let':7A 'mishandl':29B 'oauth':4A,30B,73C 'php':18B 'redirect':5A,37B,79C 'remot':8A,40B,64C 'run':10A 'runtim':19B 'self':21B 'self-host':20B 'server':53B 'uri':6A,38B,80C 'url':32B,46B,75C 'via':70C 'webasyst':1A,23B,24B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running Webasyst Framework 4.0.3 or earlier that expose its OAuth authorization flow to remote users are likely exposed. unknown whether OAuth must be actively configured for the flaw to be reachable. Teams on a later release or without Webasyst may skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-51954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51954","severity":null,"published_at":"2026-10-22T16:17:36+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-51954","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-51954","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}