CVE-2026-117553: Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using responsemode=formpost to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.