CVE-2026-92116: Apache Allura: OAuth1 missing callback validation
Published Oct 12, 2026
·Updated
OAuth1 callback validation vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version 1.22.0, which fixes the issue.
Affected Software
1 affected component
Apache Allura<=1.21.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Allurato a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Oct 12, 2026
CVE Published
via MITRE·08:04 PM
Data Sourced
via MITRE·08:04 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Apache Allura versions need to be remediated?
Apache Allura versions through 1.21.0 are affected. Upgrade to version 1.22.0, which fixes the issue.
2
What configuration or exploitation prerequisites are known?
The available information identifies missing OAuth1 callback validation, but does not specify affected OAuth1 configurations, default exposure, or attacker prerequisites.