CVE-2026-63373

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.

• CWE-352

• https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e
• https://github.com/jgraph/drawio/releases/tag/v30.2.7
• https://github.com/jgraph/drawio/security/advisories/GHSA-mcj5-3pww-7g49
• https://github.com/jgraph/drawio/security/advisories/GHSA-mcj5-3pww-7g49

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63359The Appriss Insights (Equifax) Victim Information Notificati…9.8
• CVE-2026-6336GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2026-63360LimeSurvey Community Edition 7.0.5+260623 contains an authen…7.4
• CVE-2026-63361LimeSurvey Community Edition 7.0.5 contains an authenticated…8.5
• CVE-2026-63362An unsigned integer underflow in the PubSub signature verifi…5.9
• CVE-2026-6337Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-63374AnyIO is a high level asynchronous concurrency and networkin…9.3
• CVE-2026-63376toml-node is a TOML parser for Node.js and the browser. Prio…8.2
• CVE-2026-63379Libevent is an event notification library. Prior to 2.1.13 a…6.3
• CVE-2026-6338A HTTP request smuggling and desynchronization vulnerability…4.9
• CVE-2026-63380Libevent is an event notification library. Prior to 2.2.2-al…5.7
• CVE-2026-63381Libevent is an event notification library. Prior to 2.1.13 a…5.8