pretix CVE-2026-101274

Exploitation requires that pretix be deployed as an OAuth/OIDC identity provider in an SSO setup for customer accounts (a specific, non-default feature configuration) and that at least one SSO client exists. The concrete trigger is an authorization request whose response_type (e.g., id_token) does not match the client's configured grant type (code); pretix fails to validate this, issuing a valid token without requiring the client secret. The decisive limiting factor is that the attacker must be able to run JavaScript on the page served by the redirect_uri, and that redirect_uri must already be present in the client's configured allowlist - this is why the CVSS 4.0 vector carries AT:P. Exploitation also requires high privilege (PR:H) and passive user interaction (UI:P). Organizations not using pretix as an SSO identity provider are not affected.

This is a medium-severity, access-control/token-issuance flaw in pretix's OAuth/OIDC identity-provider role, carrying a vendor-assigned CVSS 4.0 base score of 6.9. The signals point to a real but constrained issue rather than a mass-exploitation emergency. Supporting lower urgency: the vuln.today Decision label is 'this_month' (not act_now/emergency), there is no CISA KEV listing, no public exploit is referenced, and the CVSS 4.0 vector itself encodes meaningful friction - AT:P (a specific attack requirement, here the attacker must be able to execute JavaScript on an allowlisted redirect_uri page), UI:P (passive user interaction), and PR:H (high privilege). Raising concern: AV:N (network reachable), VC:H plus SC:H (high confidentiality impact on both the vulnerable system and a subsequent system - i.e., issuance of a valid token grants access to the victim's SSO-protected identity/account). Key data is MISSING and should be noted explicitly: no EPSS score is provided, so exploitation probability cannot be quantified; no SSVC decision-tree values (automatable, technical impact) are supplied; and CWE is 'N/A', so the weakness class is not formally classified. The CVSS vector supplied is CVSS 4.0 only - no CVSS 3.1 vector was provided for cross-check. Net: treat as a legitimate patch-this-cycle item for anyone running pretix as an SSO identity provider, not a high-CVSS-but-trivial-to-exploit internet-wide crisis.

An attacker who can execute JavaScript on a page served from one of a client's configured redirect_uri values crafts an OAuth authorization request that specifies a response_type (e.g., id_token) different from the client's configured grant type (code), which normally would require the client secret. Because pretix fails to validate response_type against the configured grant type, it returns a valid token, and the attacker's JavaScript captures it to impersonate the victim's SSO identity. No public exploit code is identified at time of analysis.