EUVD-2026-53397
GHSA-47mw-vx77-gwvj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description explicitly requires victim to click a crafted link (UI:R, not UI:N as official vector states); impact is integrity-only account takeover with no confidentiality or availability loss.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Insufficient Verification of Data Authenticity vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
AnalysisAI
Account takeover in Apache Answer through 2.0.1 allows unauthenticated remote attackers to seize arbitrary user accounts by exploiting a missing authorization check in the external-login OAuth email binding workflow. The attacker crafts a malicious confirmation link and socially engineers a target into clicking it, after which the attacker's external identity is silently bound to the victim's Answer account. No active exploitation has been identified (CISA KEV absent, EPSS at 7th percentile), but the SSVC framework flags the attack as automatable, making phishing-at-scale campaigns mechanically feasible.
Technical ContextAI
Apache Answer is an open-source Q&A community platform (self-hosted Stack Overflow analog) maintained by the Apache Software Foundation. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function): the external-login OAuth/SSO email binding confirmation step does not verify that the entity triggering the binding actually owns or has authority over the target account. This means an attacker can initiate a binding request targeting any registered email address and then supply the victim with the resulting confirmation link - the server accepts the binding without checking whether the confirming party is the account holder. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_answer:*:*:*:*:*:*:*:* covering all versions through 2.0.1.
RemediationAI
Upgrade to Apache Answer 2.0.2, which is the vendor-released patch confirmed by the Apache Software Foundation advisory at https://lists.apache.org/thread/mrlwtdnhqqgfbchjgq6rffkz67o8wyv8. If immediate patching is not feasible, disabling the external-login (OAuth/SSO) feature entirely eliminates the vulnerable code path; the trade-off is loss of single-sign-on functionality for all users. A secondary compensating control is restricting the Answer instance to trusted internal network segments, which limits the reachability of phishing-delivered confirmation links but does not eliminate the vulnerability if internal users can still be phished. No workaround fully substitutes for upgrading to 2.0.2.
More in Apache Answer
View allDenial of service in Apache Answer through 2.0.1 allows unauthenticated remote attackers to exhaust CPU resources by sen
Unauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pend
Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator acc
Insecure Direct Object Reference (IDOR) in Apache Answer through version 2.0.1 allows any authenticated user to delete u
Improper authorization in Apache Answer through version 2.0.1 allows any authenticated user to reject arbitrary pending
Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today