High · published January 28, 2026
⚡ A sneaky flaw in OpenProject's real-time collaboration feature could let an attacker hijack your session and mess with your projects. 🔓 Think of it like a restaurant where the server accidentally gives out the secret recipe to grumpy customers without checking their IDs first — anyone could walk up and order off your menu! An attacker could exploit this vulnerability to decrypt an intercepted token, allowing them to interact with OpenProject on behalf of the victim. This means unauthorized access to your documents, sensitive data manipulation, and even sabotage of ongoing projects. It’s like handing a stranger the keys to your office without realizing they could change everything!
Think of it like a restaurant where the server accidentally gives out the secret recipe to grumpy customers without checking their IDs first — anyone could walk up and order off your menu! This vulnerability in OpenProject 17.0 allows the synchronization server to incorrectly validate backend URLs, sending decrypted authentication tokens to untrusted endpoints. It was introduced in version 17.0.0 and fixed in 17.0.2.
An attacker could exploit this vulnerability to decrypt an intercepted token, allowing them to interact with OpenProject on behalf of the victim. This means unauthorized access to your documents, sensitive data manipulation, and even sabotage of ongoing projects. It’s like handing a stranger the keys to your office without realizing they could change everything! To protect your projects, immediately update OpenProject to version 17.0.2. If you can't update right away, disable the collaboration feature in Settings -> Documents -> Real-time collaboration -> Disable, and turn off the `hocuspocus` container as a temporary workaround. Don't wait! You've got this! Follow these steps to secure your collaboration features and keep your project safe! 🛡️