Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-91201DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage
Medium 5.4
In plain English
A medium-severity security flaw in DocsGPT from arc53. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.
Affected products (as reported)
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
References
- GitHub Issue #2766 issue-tracking
- https://github.com/arc53/DocsGPT product
- https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L515-L527 technical-description
- https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/frontend/src/components/ConnectorAuth.tsx#L57-L80 technical-description
- https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L344-L366 technical-description
- VulnCheck Advisory: DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage third-party-advisory