CVE-2026-107503

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft.

• CWE-15
• CWE-346
• CWE-522

• https://github.com/eclipse-ditto/ditto/security/advisories/GHSA-8767-g5qv-9jcf
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/380
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1207

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107466A flaw was found in flatpak-builder. This vulnerability allo…6.1
• CVE-2026-10747IBM MQ Appliance could allow a remote attacker to cause a de…10
• CVE-2026-10748An authenticated user with the nx-licensing-create privilege…7.2
• CVE-2026-10749The Post Duplicator WordPress plugin before 3.0.15 does not …7.2
• CVE-2026-1075The ZT Captcha plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2026-10750The Royal MCP WordPress plugin before 1.4.26 does not perfo…8.1
• CVE-2026-10751IBM MQ Java and JMS client libraries could allow an authenti…7.5
• CVE-2026-107510An authenticated high privilege user can inject arguments in…9.1
• CVE-2026-10753The Site Kit by Google WordPress plugin before 1.176.0 does…2.7
• CVE-2026-10754Pega Platform versions 8.5.0 through 25.1.2 are affected by …8.6
• CVE-2026-10755The All in One SEO WordPress plugin before 4.9.9 does not c…2.7
• CVE-2026-107565A flaw was found in luksmeta. A local attacker with administ…5.1