CVE-2026-45773 Turborepo: Login callback CSRF/session fixation
Attackers can hijack Turborepo CLI login sessions via CSRF on self-hosted auth flows, allowing unauthorized access to build caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45773?
CVE-2026-45773 is a medium-severity vulnerability in vercel turborepo, published on 15 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.
Which versions are affected by CVE-2026-45773?
2 open source packages ship an affected version, including turbo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
turbo npm | All versions | 2.9.14 |
turbo npm | All versions | 2.9.14 |
Products include Vercel Turborepo.
How do I fix CVE-2026-45773?
Upgrade turbo to 2.9.14 or later.
Is CVE-2026-45773 being exploited?
There is no known exploitation of CVE-2026-45773 in the wild and no public exploit code.
Other vulnerabilities in vercel turborepo
Sources
Also known as GHSA-hcf7-66rw-9f5r, MINI-8vcx-qj7x-vf4c.