Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-117553Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning

High 7.5

In plain English

A high-severity open redirect in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.

Affected products (as reported)

Vendor	Product	Versions
umbraco	Umbraco-CMS	0 – before 17.7.218.0.0 – before 18.2.2

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patch Commit patch
https://github.com/umbraco/Umbraco-CMS product
GitHub Security Advisory (GHSA-rpv9-qp4c-g469) vendor-advisory
https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112 technical-description
VulnCheck Advisory: Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning third-party-advisory