CVE-2026-42195CWE-200CWE-601

Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

Low · published May 8, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-08T21:22Z
EPSS history
Timeline
  • 08 MAY 21:22Z
    Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
    cvelistv5