Cyber ·
CVE-2026-92120: OAuth1 replay attack in Apache Allura
Low-severity advisory on an OAuth1 request replay flaw in Apache Allura up to version 1.21.0, fixed in version 1.22.0.
On 12 October 2026, the oss-sec feed published CVE-2026-92120, an OAuth1 request replay vulnerability in Apache Allura. According to the advisory, the issue affects the software up to version 1.21.0, and the fix is available in version 1.22.0. The stated severity is low. The text recommends that users update to version 1.22.0. Credit for the discovery is given to a reporter identified in the original record.
Why it matters: a replay attack resends previously captured valid requests, so administrators of Allura instances should check the version they run. Rota Nacional does not patch third-party software and is not the component affected by this advisory; the source describes no fix or dependency relationship with the platform.
How to consult and verify: open the CVE record and the original advisory through the references published on the oss-sec mailing list, confirm the installed Allura version, and compare it with version 1.22.0 listed as the fix. If the instance is in the affected range, apply the update following the project's official documentation and repeat the version check.
Original source: CVE-2026-92120: ataque de repetição OAuth1 no Apache Allura