Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-82378

Apache Roller OAuth 1.0a Authorization Bypass Allows Token Theft

Incorrect authorization in Apache Roller 6.1.5 OAuth 1.0a endpoint lets an unauthenticated attacker obtain an access token for any user. CVSS 9.0 critical.

cat cve-2026-82378.json
Vendor
Apache Software Foundation
Product
Apache Roller
CVSS
9.0
EPSS (exploit probability)
0.4%
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-82378

Is CVE-2026-82378 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-82378 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).

Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison

CVE-2026-82378 timeline

  1. Published to NVD
  2. First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

CVE-2026-82378 is an incorrect authorization vulnerability in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5. An unauthenticated attacker who obtains an outstanding request token for a site-wide OAuth consumer can exploit the authorization endpoint to receive an access token for any user, bypassing the user-approval step that is supposed to gate that exchange.

What to do: Upgrade Apache Roller to a patched version. See the NVD record and the Apache Roller GitHub fix.

Other Apache Software Foundation CVEs we track

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-90910
Apache Answer Missing Auth on Reaction APIwrite-up
[ CRITICAL ]9.80.5%—
CVE-2026-82384
Apache Roller XML-RPC Deserialization Allows Unauthenticated RCEwrite-up
[ CRITICAL ]9.81.0%—
CVE-2026-82383
Apache Roller Missing Auth Lets Attackers Change Site Configurationwrite-up
[ HIGH ]8.20.5%—
CVE-2026-82379
Apache Roller WSSE Auth Bypass via Digest Replaywrite-up
[ HIGH ]7.70.4%—
Related coverage
~/articles/2026-09-29-apache-roller-four-cves-patched
apache

Apache Roller Patches Critical XML-RPC Deserialization Bug

Apache Roller 6.1.5 has four patched vulnerabilities, including a CVSS 9.8 deserialization flaw allowing unauthenticated RCE via the XML-RPC endpoint.

read →