CVE-2026-24772: OpenProject Auth Bypass Vulnerability

CVE-2026-24772 Overview

CVE-2026-24772 is a high-severity vulnerability affecting OpenProject, an open-source, web-based project management software. The vulnerability exists in the synchronization server component introduced in OpenProject 17.0 to enable real-time collaboration on documents. Due to insufficient verification of data authenticity (CWE-345), the synchronization server fails to properly validate the backend URL, allowing an attacker to intercept and decrypt authentication tokens to impersonate legitimate users.

Critical Impact

An attacker could exploit this vulnerability to decrypt intercepted authentication tokens and gain unauthorized access to OpenProject on behalf of a victim, potentially compromising sensitive project data and enabling malicious actions within the affected workspace.

Affected Products

• OpenProject version 17.0.0
• OpenProject version 17.0.1
• OpenProject versions prior to 17.0.2

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-24772 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24772

Vulnerability Analysis

The vulnerability stems from the real-time collaboration feature introduced in OpenProject 17.0. When users collaborate on documents, the OpenProject backend generates an authentication token valid for 24 hours and encrypts it using a shared secret known only to the synchronization server. This encrypted token, along with the backend URL, is passed from the frontend to the synchronization server (hocuspocus container) to verify user permissions and enable intermittent document saves.

The critical flaw lies in the synchronization server's failure to validate the backend URL before sending a request containing the decrypted authentication token. This insufficient verification of data authenticity allows an attacker who has intercepted an encrypted token through other means (such as network sniffing or man-in-the-middle attacks) to redirect the synchronization server to a malicious endpoint they control. When the server sends the decrypted token to this attacker-controlled endpoint, the attacker obtains a valid access token to interact with OpenProject as the victim.

Root Cause

The root cause is insufficient verification of data authenticity (CWE-345) in the synchronization server component. The server accepts backend URLs without proper validation, trusting that the URL provided by the frontend is legitimate. This design flaw enables token redirection attacks where the decrypted authentication token can be exfiltrated to an attacker-controlled server.

Attack Vector

The attack requires network access and involves the following steps:

1. The attacker intercepts an encrypted authentication token during the real-time collaboration session establishment
2. The attacker crafts a malicious request to the synchronization server, substituting the legitimate backend URL with their own controlled endpoint
3. The synchronization server, failing to validate the URL, decrypts the token and sends it to the attacker's endpoint
4. The attacker receives the valid authentication token and can now impersonate the victim user within OpenProject

The vulnerability requires some user interaction as the attacker must first intercept a valid encrypted token. However, once obtained, the attacker can leverage the synchronization server to decrypt tokens without needing to know the shared encryption secret.

Detection Methods for CVE-2026-24772

Indicators of Compromise

• Unusual outbound network connections from the hocuspocus synchronization server to unexpected or external endpoints
• Authentication tokens being used from IP addresses inconsistent with the legitimate user's typical access patterns
• Anomalous document collaboration API requests originating from the synchronization server to non-standard backend URLs
• Suspicious activity in user accounts involving project modifications or data access the user did not initiate

Detection Strategies

• Monitor network traffic from the synchronization server container for connections to unexpected destinations
• Implement logging for all backend URL values processed by the synchronization server and alert on URLs that do not match the configured backend
• Review authentication logs for token usage patterns that indicate potential replay or impersonation attacks
• Deploy network segmentation rules that restrict outbound connections from the hocuspocus container to only the legitimate OpenProject backend

Monitoring Recommendations

• Enable verbose logging on the synchronization server to capture all incoming requests and backend URL parameters
• Set up alerts for authentication tokens being validated against URLs outside of the expected OpenProject infrastructure
• Monitor for multiple simultaneous sessions using the same authentication token from different network locations
• Implement rate limiting and anomaly detection on document collaboration endpoints

How to Mitigate CVE-2026-24772

Immediate Actions Required

• Upgrade OpenProject to version 17.0.2 or later immediately
• If upgrading is not immediately possible, disable the real-time collaboration feature via Settings → Documents → Real time collaboration → Disable
• Stop and disable the hocuspocus container until the patch can be applied
• Review recent collaboration activity logs for any suspicious access patterns

Patch Information

OpenProject has addressed this vulnerability in version 17.0.2. Organizations should update to this version or later to remediate the vulnerability. The patch properly validates the backend URL before the synchronization server sends decrypted authentication tokens, preventing token exfiltration to attacker-controlled endpoints.

For detailed information, refer to the GitHub Security Advisory.

Workarounds

• Disable the real-time collaboration feature through OpenProject settings as described above
• Stop the hocuspocus synchronization server container to completely eliminate the attack surface
• Implement network-level controls to restrict outbound connections from the synchronization server
• Consider implementing a Web Application Firewall (WAF) rule to validate backend URL parameters in requests to the synchronization server

# Disable hocuspocus container as a temporary workaround
docker stop hocuspocus
docker rm hocuspocus

# Or via docker-compose
docker-compose stop hocuspocus