CVE-2026-59655CWE-200information-disclosure

CVE-2026-59655

High · published August 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.

This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00595 · 47.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-21T13:16Z
Affected products (2)
ProductVersionsFixed in
apache/cloudstack≥ 4.19.0.0, < 4.20.3.14.20.3.1
apache/cloudstack≥ 4.21.0.0, < 4.22.1.14.22.1.1
References (1)
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc · [email protected]
EPSS history
Timeline
  • 21 AUG 08:28Z
    Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
    cvelistv5