CVE-2026-118196

CriticalCVSS 9.1/10Last modified Nov 12, 2026

Description

OAuth 1 rebinding vulnerability in Apache Allura.

This issue affects Apache Allura: through 1.22.0.

Users are recommended to upgrade to version 1.22.1, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Apache Software FoundationApache Allura<= 1.22.0

References

Timeline

Published
Nov 9, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181975.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipuCVE-2026-1181985.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attackerCVE-2026-1181995.5Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leCVE-2026-11824.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 thCVE-2026-118206.5A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS APICVE-2026-1182005.5Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leCVE-2026-1182017.5The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authenticaCVE-2026-1182027.5The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before cCVE-2026-1182046.4The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site ScriptCVE-2026-1182057.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in allCVE-2026-1182078.8Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-1182087.1Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-118196: Critical severity, CVSS 9.1 | Vulnix