PatchSiren

Hubzilla CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Hubzilla CVE published 2026-08-06

CVE-2026-70556

CVE-2026-70556 is a cross-site request forgery (CSRF) vulnerability in Hubzilla 11.2.1's OAuth2 /authorize endpoint. The vulnerability allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without a CSRF token or Origin/Referer validation. This enables interception of future OAuth2 authorization codes when [truncated]