CVE-2026-107503: High severity Eclipse Ditto Ditto Explorer vulnerability
Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE codeverifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled apiuri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
The attacker needs to get a victim to open a crafted Ditto Explorer link. The link injects an attacker-controlled OIDC authority with autoSso enabled, causing the UI to initiate login at the genuine identity provider but send the authorization-code exchange to the attacker-controlled token endpoint.
Which credentials or tokens can be exposed?
An attacker can redeem the intercepted authorization code and PKCE verifier for the victim's access and refresh tokens. A crafted api_uri can also cause the UI to send the victim's bearer token or Basic credentials to the attacker.
Can the impact persist after the victim closes the crafted link?
Yes. The injected configuration is persisted, so subsequent visits to the UI can repeat token theft even when the victim does not revisit the crafted link.
Which versions are identified as affected?
The affected Eclipse Ditto Explorer versions are 3.6.0 through 3.9.7.