CVE-2026-13543: Documenso Auth Bypass Vulnerability

CVE-2026-13543 Overview

CVE-2026-13543 is an improper authentication vulnerability [CWE-287] affecting Documenso versions up to 2.11.0. The flaw resides in the handle-oauth-callback-url.ts file within the packages/auth/server/lib/utils/ directory, which handles the Google OAuth login flow. Attackers can exploit this weakness remotely over the network without authentication or user interaction. The vulnerability carries high attack complexity, making exploitation difficult in practice. A public exploit exists, and the pull request that resolves the issue is pending acceptance upstream. Documenso is an open-source document signing platform, and this defect impacts the integrity of its third-party identity federation workflow.

Critical Impact
Remote attackers can abuse the Google OAuth callback logic to bypass authentication controls in Documenso, though exploitation requires overcoming high attack complexity conditions.

Affected Products

Documenso versions up to and including 2.11.0
Component: Google OAuth Login (handle-oauth-callback-url.ts)
Deployments relying on Documenso's federated authentication path

Discovery Timeline

2026-06-29 - CVE-2026-13543 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13543

Vulnerability Analysis

The vulnerability exists in Documenso's OAuth callback handling logic, specifically inside packages/auth/server/lib/utils/handle-oauth-callback-url.ts. This file processes the redirect returned by Google after a user authenticates through the OAuth 2.0 authorization code flow. Improper validation within this handler enables an attacker to influence the authentication decision without presenting valid credentials for the target account. Because the callback runs server-side and trusts values derived from the OAuth exchange, flaws here map directly to CWE-287 (Improper Authentication). Exploitation occurs remotely across the network and does not require prior privileges or user interaction on the victim side. The exploit is public, but the attack path requires specific conditions to line up, which raises complexity.

Root Cause

The root cause is insufficient verification of OAuth callback parameters before the server issues an authenticated session. When the callback handler processes untrusted input from the OAuth redirect, it fails to enforce the binding between the initiating client state and the identity returned by Google. This allows the authentication step to succeed under attacker-influenced conditions.

Attack Vector

An unauthenticated remote attacker crafts requests against the vulnerable Google OAuth callback endpoint exposed by a Documenso deployment. By manipulating callback URL parameters processed by handle-oauth-callback-url.ts, the attacker attempts to have the server accept an authentication outcome it should reject. The vector is network-based, and no local access or victim interaction is needed. Successful exploitation yields limited impact on confidentiality, integrity, and availability of the authenticated session context.

No verified proof-of-concept code has been published in a form suitable for reproduction here. Refer to the GitHub Issue #2758 and Pull Request #2837 for the technical discussion and pending fix.

Detection Methods for CVE-2026-13543

Indicators of Compromise

Unexpected successful Google OAuth callbacks in Documenso logs that do not correlate with a preceding authorization request from the same client session
Session establishment events for user accounts without matching Google identity provider assertions in application audit trails
Anomalous request patterns targeting the /auth/callback or equivalent OAuth callback route in Documenso

Detection Strategies

Enable verbose logging on the OAuth callback handler and correlate state parameter values with previously issued authorization requests
Alert on mismatches between the state value stored server-side and the value returned in the callback URL
Review application logs for authentication successes that lack corresponding token exchange records with Google's OAuth endpoints

Monitoring Recommendations

Instrument the Documenso authentication service to emit structured events for every OAuth callback outcome, including failure reasons
Forward authentication telemetry to a centralized log platform and build detections around callback anomalies and impossible-travel session creation
Monitor upstream traffic to accounts.google.com token endpoints and compare volume to observed Documenso login successes

How to Mitigate CVE-2026-13543

Immediate Actions Required

Restrict exposure of the Documenso authentication endpoints to trusted networks until a patched release is available
Rotate any OAuth client secrets configured for Documenso's Google identity provider integration
Invalidate active sessions and force re-authentication for all users
Audit user accounts and recent document activity for unauthorized access indicators

Patch Information

No official fixed release has been published at the time of this advisory. A pull request that addresses the flaw is tracked as GitHub Pull Request #2837 and awaits acceptance. Monitor the Documenso repository for a tagged release after 2.11.0 that incorporates the fix. Additional tracking is available via VulDB CVE-2026-13543.

Workarounds

Temporarily disable the Google OAuth login provider in Documenso and require email or SSO-based authentication through a trusted identity provider
Place the Documenso application behind a reverse proxy that enforces strict validation of OAuth state and code parameters before forwarding requests
Apply the diff from Pull Request #2837 as an out-of-tree patch after independent code review

bash

# Configuration example: disable Google OAuth provider in Documenso environment
NEXT_PUBLIC_FEATURE_GOOGLE_SSO_ENABLED=false
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=