CVE-2026-91201CWE-346

CVE-2026-91201

Medium · published September 15, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-09-15T03:19Z
References (6)
https://github.com/arc53/DocsGPT · [email protected]https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L344-L366 · [email protected]https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L515-L527 · [email protected]https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/frontend/src/components/ConnectorAuth.tsx#L57-L80 · [email protected]https://github.com/arc53/DocsGPT/issues/2766 · [email protected]https://www.vulncheck.com/advisories/docsgpt-through-0.20.0-oauth-token-disclosure-via-wildcard-postmessage · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 22:10Z
    DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage
    cvelistv5