Security · High impactFan score 20 · Tier C

CVE-2026-118196: Apache Allura: OAuth1 rebinding

oss-security · 14h ago

The Brief

CVE-2026-118196, an OAuth 1 rebinding vulnerability, affects Apache Allura through 1.22.0.
The advisory rates the issue critical.
Users are recommended to upgrade to Apache Allura 1.22.1, which fixes the flaw.

Why it matters

Teams running Apache Allura 1.22.0 or earlier should upgrade to 1.22.1 because the vulnerability is rated critical.

Who’s affected

Anyone running Apache Allura through 1.22.0

What to do

Upgrade Apache Allura to version 1.22.1

Apache Allura 1.22.0
Apache Allura 1.22.1
CVE-2026-118196
#security
#apache-allura
#oauth
#vulnerability
#cve-2026-118196

Posted by Dave Brondsema on Nov 06 Severity: critical Affected versions: - Apache Allura through 1.22.0 Description: OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes…

Read the full story at seclists.org ↗

Timeline

Nov 6
Vulnerability disclosed in oss-sec advisory posted by Dave Brondsema
Nov 7 · 1:29 AM
Open Source Security
CVE-2026-118196: Apache Allura: OAuth1 rebinding