EUVD-2026-53869
GHSA-q8qh-69f5-v25q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-based CSRF with no attacker privileges required (PR:N), mandatory victim interaction (UI:R), and integrity impact limited to OAuth2 app registration (I:L) with no confidentiality or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.
AnalysisAI
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
Technical ContextAI
Hubzilla is an open-source, self-hosted federated social networking and collaboration platform. The vulnerable component is Zotlabs\Module\Authorize::post(), the server-side handler for POST requests to the OAuth2 /authorize endpoint. CWE-352 (Cross-Site Request Forgery) identifies the root cause class: the handler relies exclusively on the presence of a valid session cookie to authenticate the requesting user but performs no synchronizer-token pattern, double-submit-cookie, or SameSite-cookie enforcement. Because browsers automatically attach session cookies to cross-origin requests, a forged form POST from any attacker-controlled origin is indistinguishable server-side from a legitimate request. The absence of Origin or Referer header validation eliminates a secondary mitigation layer. The affected CPE cpe:2.3:a:hubzilla:hubzilla:*:*:*:*:*:*:*:* covers the entire version history through 11.2.1, suggesting no prior hardening of this endpoint. The OAuth2 application registration mechanism is a standard Hubzilla feature, so no non-default configuration is required to expose the endpoint.
RemediationAI
A vendor fix has been applied to the dev branch of the Hubzilla core repository, referenced at https://framagit.org/hubzilla/core/-/blob/dev/Zotlabs/Module/Authorize.php?ref_type=heads#L49. Instance administrators should update to the next tagged release incorporating this patch; however, an exact patched release version number has not been confirmed from the available data - only the dev branch commit is referenced, not a formally released build. Administrators should monitor https://framagit.org/hubzilla/core for a tagged release and the VulnCheck advisory at https://www.vulncheck.com/advisories/hubzilla-csrf-via-oauth2-authorize-endpoint-app-registration for confirmation. As a compensating control pending upgrade, administrators can restrict POST access to the /authorize endpoint at the reverse-proxy or web server layer to block requests lacking a valid SameSite-enforced session, though this may disrupt legitimate third-party OAuth2 integrations. If OAuth2 application registration is not required for the instance's use case, disabling the OAuth2 feature entirely eliminates exposure with no impact to non-OAuth2 users. Reviewing already-registered OAuth2 applications for unauthorized entries is advised for any instance that may have been exposed.
A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers t
A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote atta
Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today