Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck

CVE-2026-70556Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration

Medium 4.3

In plain English

A medium-severity cross-site request forgery in Hubzilla from Hubzilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.

Affected products (as reported)

Vendor	Product	Versions
Hubzilla	Hubzilla	0 – before 11.4

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Product Advisory product
Proof of Concept Video technical-description
Patch Commit patch
https://www.vulncheck.com/advisories/hubzilla-csrf-via-oauth2-authorize-endpoint-app-registration third-party-advisory