CVE-2026-92116

CVSS 9.1 (critical) · published 2026-10-12

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

Weakness: CWE-601

Source: NVD CVE-2026-92116

References

• https://lists.apache.org/thread.html/d716zfvgpnrjlsc7bmysv4sxbnh2b57f
• http://www.openwall.com/lists/oss-security/2026/10/12/3

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.