CVE-2026-91201 arc53 CVE debrief

Who should care

Defenders responsible for the security of DocsGPT deployments should assess their exposure to this vulnerability and prioritize verification and remediation efforts. They should verify the use of DocsGPT in their environment, check for exposure to the vulnerable callback-status endpoint, and ensure that OAuth connector session tokens are properly validated.

Why it matters

CVE-2026-91201 is a medium-severity vulnerability in DocsGPT through 0.20.0, where OAuth connector session tokens are posted to a wildcard target origin in the callback-status endpoint without validating sender origin. Defenders should prioritize verifying the use of DocsGPT in their environment, checking for exposure to the vulnerable callback-status endpoint, and ensuring that OAuth connector session tokens are properly validated.

• Obtain session tokens and provider account emails by acting as window.opener during OAuth authorization.
• Use tokens to disconnect victims' cloud storage connectors.

Technical summary

The vulnerability exists in the DocsGPT API connector routes, specifically in the callback-status endpoint, where OAuth connector session tokens are posted to a wildcard target origin without validating sender origin. This allows attackers to obtain session tokens and provider account emails by acting as window.opener during OAuth authorization. The vulnerability is a medium-severity issue in DocsGPT through 0.20.0. Defenders should prioritize verifying the use of DocsGPT in their environment, checking for exposure to the vulnerable callback-status endpoint, and ensuring that OAuth connector session tokens are properly validated.

Defensive priority

Defenders should prioritize verifying the use of DocsGPT in their environment, checking for exposure to the vulnerable callback-status endpoint, and ensuring that OAuth connector session tokens are properly validated.

Recommended defensive actions

• Verify the use of DocsGPT in your environment and check for exposure to the vulnerable callback-status endpoint.
• Ensure that OAuth connector session tokens are properly validated and not posted to a wildcard target origin.
• Review and update DocsGPT to a version that fixes the vulnerability, if available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Vulncheck and is publicly disclosed in the CVE Program record and the NIST National Vulnerability Database. The source details are limited, and defenders should verify the use of DocsGPT in their environment and check for exposure to the vulnerable callback-status endpoint. The vulnerability allows attackers to obtain session tokens and provider account emails by acting as window.opener during OAuth authorization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.