CVE-2026-111622

MediumCVSS 6.8

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Summary

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.

Risk Assessment

OAuth2 access token theft — full user account takeover and access to protected resources. Can lead to data breaches and privilege escalation in integrated applications.

Recommendation

Upgrade smart-sso beyond 2.1.1 once available and implement redirectUri validation against an allowlist of permitted addresses. Until a fix is released, consider monitoring for unusual redirects.

Other vulnerabilities in smart-sso

CVE-2026-121543High
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS