CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
Attackers can hijack victim sessions in self-hosted draw.io deployments by bypassing OAuth state validation, causing victims to act under the attacker's cloud identity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-63373?
CVE-2026-63373 is a medium-severity vulnerability in jgraph drawio, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.
Weakness: CWE-352
Which versions are affected by CVE-2026-63373?
How do I fix CVE-2026-63373?
No fix has been published for CVE-2026-63373 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-63373 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63373 exists.
Sources
Also known as GHSA-mcj5-3pww-7g49.