CVE-2026-51954
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An issue in Webasyst Framework 4.0.3 and earlier allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.
Risk Assessment
An attacker could take control of the application by executing arbitrary code, potentially leading to data leakage or full system compromise.
Recommendation
Update Webasyst Framework to a version later than 4.0.3 and verify proper validation of the redirect_uri parameter in the OAuth flow.
Other vulnerabilities in Webasyst Framework
See all- CVE-2026-116213Medium
Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.
- CVE-2026-116212Medium
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
- CVE-2026-116210Medium
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
Original NVD description (English source)
An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS