CVE-2026-29782CWE-502

OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

High · published April 2, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00691 · 52.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-04-02T13:42Z
EPSS history
Timeline
  • 02 APR 13:42Z
    OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2
    cvelistv5