EUVD-2026-28833Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Network-delivered via crafted URL, no attacker privileges required, but AC:H due to social engineering; scope changes to OAuth context with limited confidentiality loss only.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.
AnalysisAI
Open redirect in draw.io's GitLab OAuth flow allows an attacker to hijack the authorization popup by supplying a crafted ?gitlab= URL parameter, replacing the legitimate GitLab server with an attacker-controlled host. All draw.io versions prior to 29.7.9 are affected; users who follow a crafted link and click through the 'Authorize in GitLab' dialog expose their credentials and OAuth state tokens to the attacker's phishing endpoint. No public exploit has been identified and CISA has not listed this in KEV, but the social-engineering barrier is low given draw.io's shareable-URL model.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) describes this root cause precisely: the draw.io client-side application accepts the ?gitlab= query parameter and passes it unsanitized into the OAuth popup initialization logic, substituting it for the expected gitlab.com endpoint without origin validation. The affected component is the client-side OAuth integration within draw.io's diagramming frontend, identified under CPE cpe:2.3:a:jgraph:drawio:*:*:*:*:*:*:*:* for all releases before 29.7.9. The GitLab OAuth flow relies on a popup window that must open on the identity provider's origin; bypassing this to an attacker-controlled host breaks the trust boundary the OAuth protocol depends on, enabling both credential phishing and interception of the OAuth state token.
RemediationAI
Upgrade draw.io to version 29.7.9 or later; this is the vendor-confirmed patch, available at https://github.com/jgraph/drawio/releases/tag/v29.7.9 and documented in the security advisory at https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x. For self-hosted draw.io deployments where immediate upgrade is not feasible, operators can mitigate by stripping the ?gitlab= query parameter at the reverse proxy or WAF layer - note this will break self-hosted GitLab OAuth integrations where a custom server URL is legitimately needed, so evaluate the trade-off carefully before applying. For draw.io Online (diagrams.net) or desktop clients, parameter stripping is not operator-controllable, making the upgrade the only reliable fix. User awareness training on verifying OAuth popup origins (confirming the popup URL is gitlab.com before entering credentials) provides a weak but additive compensating control.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today