Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-118196 EUVD-2026-119928GHSA-jcr4-cf4x-qrxg

Apache Allura: OAuth1 rebinding

Published Nov 9, 2026 · Updated Nov 12, 2026 · Assigned by apache

Description

OAuth 1 rebinding vulnerability in Apache Allura.

This issue affects Apache Allura: through 1.22.0.

Users are recommended to upgrade to version 1.22.1, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Allura ≤ 1.22.0 —

References