Permanent story citation

CVE-2026-92120: Apache Allura: Oauth1 Replay Attack

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10052

As cited

Copy frozen at 2026-10-12 21:48 UTC (site build).

vulnerabilities

CVE-2026-92120: Apache Allura: Oauth1 Replay Attack

CVE-2026-92120 is a low-severity OAuth1 request replay attack vulnerability in Apache Allura through version 1.21.0. The project recommends upgrading to version 1.22.0 to resolve the issue.

Why it matters: Organizations running Apache Allura up to 1.21.0 should plan an upgrade to 1.22.0 to eliminate the OAuth1 replay attack surface.

CVEsCVE-2026-92120

Source published: 2026-10-12 20:09 UTC
First seen by Cybersecurity Tracker: 2026-10-12 20:38 UTC

Source attribution

oss-security