CVE-2026-70556 Hubzilla CVE debrief

Who should care

Administrators and users of Hubzilla 11.2.1, security teams monitoring for OAuth2-related vulnerabilities, and developers using Hubzilla's OAuth2 functionality should be aware of this CSRF vulnerability and take defensive actions to prevent exploitation. This includes verifying Hubzilla installations, implementing compensating controls, and monitoring for suspicious OAuth2 application registrations and authorization code usage.

Technical summary

CVE-2026-70556 is a cross-site request forgery (CSRF) vulnerability in Hubzilla 11.2.1's OAuth2 /authorize endpoint. The vulnerability allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without a CSRF token or Origin/Referer validation. This enables interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client. The vulnerability has a CVSS score of 5.1 and a medium severity.

Defensive priority

Medium-priority defensive actions are required to address this CSRF vulnerability in Hubzilla's OAuth2 /authorize endpoint.

Recommended defensive actions

• Verify Hubzilla installations for version 11.2.1 and apply vendor patches or updates if available.
• Implement compensating controls such as validating CSRF tokens and Origin/Referer headers for OAuth2 requests.
• Monitor for suspicious OAuth2 application registrations and authorization code usage.
• Consider temporarily disabling OAuth2 functionality until a patch is applied.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE description indicates a cross-site request forgery vulnerability in Hubzilla 11.2.1's OAuth2 /authorize endpoint. Evidence is limited, and further verification is needed to determine the full scope of affected systems and vendor remediation efforts. The vulnerability allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without a CSRF token or Origin/Referer validation. Limited source details are available, and defenders should verify Hubzilla installations, review OAuth2 application registrations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.