CVE-2026-63630

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.

• CWE-201
• CWE-502

• https://github.com/alam00000/bentopdf/commit/b21f602cca972320bfffbf72e37df535313a6e48
• https://github.com/alam00000/bentopdf/releases/tag/v2.8.7
• https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63621Improper Input Validation, Improper Neutralization of Specia…5.3
• CVE-2026-63622A flaw was found in libvirt. A local attacker, specifically …7.8
• CVE-2026-63623A flaw was found in libvirt. During storage volume clone or …5.5
• CVE-2026-63627mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-63628mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-6363Type Confusion in V8 in Google Chrome prior to 147.0.7727.10…8.8
• CVE-2026-63632Open Neural Network Exchange (ONNX) is an open standard for …3.3
• CVE-2026-63633FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-63635OpenImageIO is a toolset for reading, writing, and manipulat…5.5
• CVE-2026-63637Dgraph is an open source distributed GraphQL database. Prior…8.6
• CVE-2026-63638OpenImageIO is a toolset for reading, writing, and manipulat…8.3
• CVE-2026-63639Valkey is a distributed key-value database. Prior to 7.2.14,…8.8