draw.io CVE-2026-63373

Exploitation requires a self-hosted draw.io deployment running as Docker or WAR where IS_GAE is false (the Google App Engine / app.diagrams.net SaaS build sets IS_GAE=true and is NOT affected). At least one OAuth cloud-storage integration must be configured (Google Drive, OneDrive, GitHub, GitLab, or Dropbox - the shared AbsAuth handler covers all five). The attacker must first complete a legitimate OAuth authorization for their OWN cloud account to obtain a valid authorization code, then induce the victim to visit the crafted callback URL (UI:R - user interaction / social engineering required). Limiting factors: the attack yields only attacker-controlled identity binding, not read access to the victim's existing cloud files, and it fails against the hosted SaaS and any GAE-based deployment.

This is a genuinely low-to-moderate priority issue, and the signals agree rather than conflict. The vendor CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) accurately captures a login-CSRF / OAuth identity-fixation flaw: network-reachable and unauthenticated (PR:N) but requiring both attacker preparation (obtaining a valid authorization code for the attacker's own cloud-storage account) and victim interaction (UI:R - the victim must click the crafted callback URL) mid-OAuth-flow, hence AC:H. Impact is deliberately bounded to C:L/I:L because the description explicitly states the identity binding does NOT grant access to the victim's existing cloud files - it only causes the victim's session to act under the attacker's identity (misattribution). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis. This is a real, correctly-scoped session-integrity bug, not a high-CVSS-but-hollow finding, but the low impact ceiling plus AC:H and UI:R mean it is not an urgent patch for most defenders. Note also the exposure is gated: only self-hosted Docker/WAR deployments (IS_GAE=false) are affected - the hosted app.diagrams.net SaaS running on GAE was never vulnerable, confirmed by the code path (IS_GAE-gated check).

An attacker starts an OAuth flow with (e.g.) Google Drive using their own account, captures the resulting authorization code, and crafts a draw.io callback URL embedding that code. They phish a victim who uses a self-hosted draw.io Docker/WAR instance into clicking the link; because the non-GAE code path skips the state/cookie token comparison, the victim's draw.io session silently binds to the attacker's cloud-storage identity, and any diagrams the victim saves land in the attacker's storage. No public exploit code was provided, but the flaw is straightforward to reproduce given the disclosed root cause.