CVE-2026-111622 a466350665 CVE debrief

Who should care

Defenders responsible for smart-sso instances, particularly those using OAuth2 for authorization, should assess exposure and prioritize remediation due to the potential for authorization code theft.

Why it matters

CVE-2026-111622 is a high-severity vulnerability in smart-sso through 2.1.1 that allows attackers to steal OAuth2 authorization codes via an open redirect vulnerability. Defenders should verify exposure, prioritize remediation, and monitor for suspicious activity.

• Potential theft of OAuth2 authorization codes by unauthenticated attackers
• Possible unauthorized access to victims' accounts through stolen access tokens
• Need for verification of smart-sso version and exposure to the vulnerability
• Priority on updating or patching vulnerable smart-sso instances

Technical summary

The smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. The vulnerability can be exploited by sending crafted /login links to users with active SSO sessions, then redeeming stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens. This issue affects smart-sso instances using OAuth2 for authorization and allows attackers to potentially steal OAuth2 authorization codes and gain unauthorized access to victims' accounts.

Defensive priority

Defenders should prioritize verifying and remediating smart-sso versions up to 2.1.1 for the open redirect vulnerability allowing OAuth2 authorization code theft.

Recommended defensive actions

• Verify smart-sso versions up to 2.1.1 for vulnerability to OAuth2 authorization code theft via unvalidated redirectUri.
• Remediate vulnerable smart-sso instances by updating to a version beyond 2.1.1 if available.
• Monitor for suspicious /login requests with unvalidated redirectUri parameters.
• Implement additional authentication and authorization checks for OAuth2 authorization codes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item describe an open redirect vulnerability in smart-sso through 2.1.1 that allows unauthenticated attackers to steal OAuth2 authorization codes. The vulnerability is in the /login handler and involves an unvalidated redirectUri parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.