EUVD-2026-78210
GHSA-x85x-q6hq-hm4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges needed, but requires victim to initiate OAuth from attacker-controlled opener; limited confidentiality and availability impact only.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.
AnalysisAI
DocsGPT through version 0.20.0 leaks OAuth connector session tokens and provider account emails to attacker-controlled windows via an insecure postMessage implementation. The callback-status endpoint broadcasts OAuth tokens using a wildcard target origin ('*') without validating the sender's origin, allowing any page acting as window.opener during the OAuth authorization flow to intercept the message payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to initiate an OAuth cloud storage connector authorization flow (e.g., Google Drive integration) while the attacker controls or influences the window.opener of the OAuth popup - typically achieved by having the victim navigate to the OAuth flow from an attacker-controlled page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L) reflects a network-reachable, low-complexity flaw requiring user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix requires replacing the wildcard postMessage target origin ('*') with an explicit, allowlisted origin in both the backend callback-status endpoint (routes.py lines 344-366 and 515-527) and the frontend ConnectorAuth.tsx component. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today