CVE-2026-63373: draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
draw.ioto a version that resolves this vulnerability.Fixed in 30.2.7
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects self-hosted draw.io Docker and WAR deployments where IS_GAE is false. The vulnerable OAuth callback handler is shared by the Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations.
What does an attacker need to exploit this?
An attacker needs an authorization code for their own cloud-storage identity and must induce a victim to visit a crafted OAuth callback URL. No authentication is required of the attacker, but victim interaction is required.
What is the impact on the victim's cloud data?
The victim's draw.io session can be bound to the attacker's cloud-storage identity, so actions may be performed and attributed under that identity. This binding flaw does not itself give the attacker access to the victim's existing cloud files.
How can this be remediated?
Upgrade draw.io to version 30.2.7, which fixes the missing state-token validation.