https://seclists.org/oss-sec/2026/q3/943: CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts quest-supplied identity
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Apache Roller 6.1.5 installations that have configured an OAuth 1.0a site-wide consumer are affected. Installations without such a consumer configured are not affected by the described flaw.
What does an attacker need to exploit it?
The attacker must learn an outstanding request token belonging to a configured site-wide consumer. They can then submit an unsigned authorization request and do not need to be authenticated.
What could a successful attacker do?
A successful attacker can bind the outstanding request token to an arbitrary Roller user account, including an administrator account. This occurs because the authorization endpoint accepts an identity supplied in the request rather than using the authenticated session identity.
What is the recommended remediation?
Upgrade Apache Roller to version 6.1.6 or later. The fixed behavior binds OAuth authorization to the logged-in session.