Apache Answer CVE-2026-48911

The external-login (OAuth/SSO) feature must be enabled in the Apache Answer deployment - instances with only local authentication active are not exposed to this specific flow. The attacker must know or be able to enumerate a target user's registered email address. Most critically, a victim must be socially engineered into clicking a specially crafted confirmation link, which introduces a mandatory human interaction step that limits opportunistic automated exploitation despite SSVC's Automatable: yes classification (which applies to link generation, not victim action). The official CVSS vector (UI:N) conflicts with this description-stated requirement for victim interaction - defenders should treat UI:R as the realistic condition until Apache clarifies. Exploitation is limited to Apache Answer 2.0.1 and earlier; the attacker requires no authentication or privileges on the target system.

The official CVSS base score of 7.5 (High) uses UI:N (no user interaction required), but the vendor description explicitly states the attack requires tricking victims into clicking a crafted confirmation link - a UI:R scenario that would reduce the base score to approximately 6.5 (Medium). This discrepancy is material and should be verified with the Apache Security Team before using the 7.5 score for patching prioritization. EPSS at 0.17% (7th percentile) indicates very low current exploitation probability, consistent with SSVC Exploitation: none and the absence of a CISA KEV listing. SSVC flags the attack as Automatable: yes, which refers to the attacker's ability to programmatically generate phishing links at scale - not to automated victim compromise. Technical Impact is assessed as partial (integrity only, no confidentiality or availability loss). Real-world risk is moderate: full account takeover is a high-value impact, but the phishing dependency materially limits opportunistic mass exploitation.

An attacker who knows a target user's registered email address initiates the external-login email binding flow in Apache Answer, generating a crafted confirmation link tied to that victim's account. The attacker delivers the link via a phishing email or message; once the victim clicks it, the server binds the attacker's external OAuth identity to the victim's Answer account without further verification. No public exploit code has been identified at time of analysis, but the attack is mechanically straightforward for any developer familiar with OAuth binding flows.