CVE-2026-45773

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.

• CWE-352
• CWE-384

• https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5rVendor Advisory

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45768Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-45769Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-4577A vulnerability was found in code-projects Exam Form Submiss…2.4
• CVE-2026-45770Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-45771FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-45772Turborepo is a high-performance build system for JavaScript …9.8
• CVE-2026-45774compliance-trestle is a tooling platform for managing compli…6.9
• CVE-2026-45775Discourse is an open-source discussion platform. From versio…6.8
• CVE-2026-45776OpenXDMoD is an open framework for collecting and analyzing …4.3
• CVE-2026-45777OpenXDMoD is an open framework for collecting and analyzing …9.8
• CVE-2026-45778OpenXDMoD is an open framework for collecting and analyzing …5.4
• CVE-2026-45779OpenXDMoD is an open framework for collecting and analyzing …9.8