CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

High 7.7 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117553?

CVE-2026-117553 is a high-severity vulnerability in Umbraco-CMS, published on 27 Oct 2026.

Official description

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.

Weakness: CWE-601

Which versions are affected by CVE-2026-117553?

How do I fix CVE-2026-117553?

No fix has been published for CVE-2026-117553 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117553 being exploited?

There is no known exploitation of CVE-2026-117553 in the wild and no public exploit code.

Sources

Also known as GHSA-r8f2-fxjr-gx5r, GHSA-rpv9-qp4c-g469.