Cyber ·
CVE-2026-92116: missing OAuth1 callback validation in Apache Allura
An OAuth1 callback validation flaw affects Apache Allura up to version 1.21.0. Version 1.22.0 fixes the issue, according to an advisory published on October 12, 2026 on the oss-sec list, with severity rated important.
The advisory describes a validation flaw in the OAuth1 callback of Apache Allura, a project and code management software. According to the text, the problem affects all versions up to and including 1.21.0. The recommendation is to update to version 1.22.0, which fixes the flaw. The reported severity is important. The advisory was published by a maintainer on the oss-sec list on October 12, 2026, and the identifier is CVE-2026-92116. The source text states it was machine-translated from the original, so check technical terms against the source. Relevance: Rota Nacional does not run or patch Apache Allura, and this content does not describe any platform feature. To verify the original, consult the official CVE record and the oss-sec posting through the public channels named in the material itself. To confirm your exposure, identify whether your organization uses Allura, which version is installed, and compare it with 1.22.0. If you use AI to study the advisory, do not paste credentials, real configurations, access keys or personal data; remove those items before any query.
Original source: CVE-2026-92116: validação ausente de callback OAuth1 no Apache Allura