Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-92116 EUVD-2026-97829GHSA-6j5w-w523-6q83

Apache Allura: OAuth1 missing callback validation

Published Oct 12, 2026 · Updated Oct 16, 2026 · Assigned by apache

Description

OAuth1 callback validation vulnerability in Apache Allura.

This issue affects Apache Allura: through 1.21.0.

Users are recommended to upgrade to version 1.22.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Allura ≤ 1.21.0 —

References