What is CVE-2026-70556?
CVE-2026-70556 is a Cross-Site Request Forgery vulnerability in the OAuth2 /authorize endpoint of Hubzilla 11.2.1. This flaw allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a crafted cross-origin POST request. Users should update their Hubzilla instance to the latest patched version.
Azərbaycanca: CVE-2026-70556, Hubzilla 11.2.1 platformasının OAuth2 /authorize endpoint-ində aşkar edilmiş CSRF (Cross-Site Request Forgery) zəifliyidir. Bu zəiflik autentifikasiya olunmamış hücumçulara, istifadəçinin autentifikasiya olunmuş sessiyası altında özbaşına OAuth2 tətbiqlərini qeydiyyatdan keçirməyə imkan verir. İstifadəçilərə dərhal Hubzilla instansiyasını ən son versiyaya yeniləmələri tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-352
FAQ2
What version of Hubzilla is affected by CVE-2026-70556?
CVE-2026-70556 affects Hubzilla version 11.2.1.
What can an attacker achieve by exploiting CVE-2026-70556?
An unauthenticated attacker can register arbitrary OAuth2 applications under an authenticated user's account.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.