CVE-2026-111622
MEDIUM
CVSS 6.8
Published: 2026-10-16
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
Quick Facts
| CVE ID | CVE-2026-111622 |
| CVSS Score | 6.8 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| Published | 2026-10-16 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/a466350665/smart-sso
- https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso…
- https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso…
- https://github.com/a466350665/smart-sso/blob/2.1.1/smart-sso…
- https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-…
- https://www.vulncheck.com/advisories/smart-sso-through-2.1.1…
- https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-…