CVE-2026-70556

Name of the Vulnerable Software and Affected Versions Hubzilla versions prior to 11.4

Description A cross-site request forgery (CSRF) issue exists in the OAuth2 '/authorize' endpoint, which is handled by the post() function within ZotlabsModuleAuthorize. This occurs because the system fails to validate CSRF tokens or the Origin/Referer headers during cross-origin POST requests. An unauthenticated attacker can exploit this by using a malicious HTML form to submit arbitrary OAuth2 parameters, such as client id, client secret, redirect uri, and scope. This allows the attacker to silently register a persistent OAuth2 application under an authenticated user's account, potentially leading to the interception of future OAuth2 authorization codes when the victim authenticates against the attacker-controlled client.

Recommendations Update to version 11.4 or later. As a temporary mitigation, restrict access to the '/authorize' endpoint or implement strict Origin/Referer validation for OAuth2 registration requests.