PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92120 Apache Software Foundation CVE debrief

Apache Allura is vulnerable to an OAuth1 Request Replay Attack. This issue affects Apache Allura through version 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue. The vulnerability allows for potential replay attacks if not upgraded. Defenders should verify current version and exposure, and prioritize upgrading to the fixed version. The CVE record and source item provide limited information about the vulnerability, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Vendor
Apache Software Foundation
Product
Apache Allura
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Apache Allura deployments should assess exposure and prioritize upgrading to version 1.22.0 or later. They should verify current version and exposure, and review compensating controls for exposed systems while remediation is scheduled and verified. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the vulnerability and its potential for

Why it matters

Defenders should care about CVE-2026-92120 because it affects Apache Allura through version 1.21.0, allowing for potential replay attacks. They should verify exposure, prioritize upgrading to version 1.22.0 or later, and monitor for potential attacks.

  • Potential for replay attacks if not upgraded
  • Need to verify current version and exposure
  • Priority on upgrading to fixed version 1.22.0

Technical summary

Apache Allura is vulnerable to an OAuth1 Request Replay Attack. The issue affects Apache Allura through version 1.21.0 and is fixed in version 1.22.0. The vulnerability is caused by a weakness in the OAuth1 implementation, allowing attackers to replay requests. Defenders should prioritize verifying exposure and upgrading to version 1.22.0 or later. The affected versions are through 1.21.0, and the fix is in version 1.22.0.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 1.22.0 or later.

Recommended defensive actions

  • Verify exposure by checking current Apache Allura version
  • Upgrade to version 1.22.0 or later
  • Monitor for potential replay attacks

Evidence notes

The CVE record and source item provide limited information about the vulnerability. The affected versions are through 1.21.0, and the fix is in version 1.22.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92120 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92120

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92120 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92120

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Apache Allura: Oauth1 Replay Attack

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92120.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://lists.apache.org/thread.html/xpo1wbh1m18tvn9ow3h599wgcswbvn5x

    Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.