CVE-2026-63373

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7

Description The OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java fails to compare stateToken and cookieToken when IS GAE is false, impacting self-hosted Docker and WAR deployments. This allows an attacker to provide an authorization code for their own cloud-storage identity and trick a victim into visiting a callback URL. Consequently, the victim's session is authenticated as the attacker's identity without a valid state binding. This issue affects integrations with Google Drive, OneDrive, GitHub, GitLab, and Dropbox, leading to session integrity loss and misattribution, although it does not grant access to the victim's existing cloud files.

Recommendations Update to version 30.2.7.