CVE-2026-51954: Webasyst Framework RCE Vulnerability

CVE-2026-51954 Overview

CVE-2026-51954 affects Webasyst Framework version 4.0.3 and earlier. The vulnerability stems from unvalidated redirect_uri handling in the OAuth authorization flow. A remote attacker can craft an OAuth authorization URL that redirects the authorization code to an attacker-controlled endpoint. Successful exploitation lets the attacker intercept the authorization code and obtain persistent API access on behalf of the victim.

Critical Impact

Attackers can hijack OAuth authorization codes through crafted redirect_uri parameters, achieving arbitrary code execution and permanent API access against vulnerable Webasyst Framework installations.

Affected Products

• Webasyst Framework 4.0.3
• Webasyst Framework versions prior to 4.0.3
• Applications built on vulnerable Webasyst Framework releases

Discovery Timeline

• 2026-10-22 - CVE-2026-51954 published to the National Vulnerability Database
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-51954

Vulnerability Analysis

The Webasyst Framework exposes an OAuth 2.0 authorization endpoint that accepts a redirect_uri parameter. The framework fails to validate this parameter against a pre-registered allowlist for the client application. An attacker can construct an authorization URL that references a legitimate client identifier while pointing redirect_uri to an attacker-controlled host.

When a victim with an active Webasyst session follows the crafted link, the authorization server issues an authorization code and redirects the browser to the attacker's URL. The attacker then exchanges the intercepted code for an access token, obtaining durable API access with the victim's privileges. Public exploitation details are available in the GitHub PoC repository and the Webasyst Forum Security Alert.

Root Cause

The root cause is missing validation of the redirect_uri request parameter during the OAuth authorization request. RFC 6749 requires strict matching of redirect_uri against values registered for the client. Webasyst Framework does not enforce this check, which classifies the flaw as an Open Redirect leading to authorization code interception.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to an authenticated Webasyst user through phishing, chat, or embedded links. The URL targets the Webasyst OAuth authorization endpoint using a valid client_id and an attacker-controlled redirect_uri. After victim interaction, the authorization server emits a redirect carrying the code parameter to the attacker's domain. The attacker completes the OAuth token exchange and retains API access until the token or grant is revoked. See the GitHub Issue Discussion for additional context.

Detection Methods for CVE-2026-51954

Indicators of Compromise

• OAuth authorization requests where redirect_uri references hosts outside the organization's registered domains.
• Outbound HTTP 302 responses from the Webasyst OAuth endpoint sending code parameters to unfamiliar external URLs.
• API access tokens issued to client applications from source IP addresses that have never previously used that client.
• Persistent API calls using tokens tied to user accounts whose session activity does not match the token usage pattern.

Detection Strategies

• Parse web server and application logs for authorization endpoint hits and alert on redirect_uri values that fail an allowlist comparison.
• Correlate issued authorization codes with subsequent token exchange source IPs to identify geographic or ASN mismatches.
• Deploy web application firewall rules that block OAuth requests containing external redirect_uri values for internal client identifiers.

Monitoring Recommendations

• Enable verbose logging on the Webasyst OAuth authorization and token endpoints and forward events to a central SIEM.
• Monitor API token issuance volume for anomalies and alert on tokens that remain active past expected session lifetimes.
• Review OAuth client registrations regularly and remove unused or legacy redirect_uri entries.

How to Mitigate CVE-2026-51954

Immediate Actions Required

• Inventory all Webasyst Framework deployments and identify instances running version 4.0.3 or earlier.
• Revoke all currently issued OAuth access tokens and refresh tokens to invalidate any codes an attacker may have intercepted.
• Restrict access to the Webasyst OAuth authorization endpoint behind network controls or require re-authentication until a patched build is deployed.
• Notify Webasyst users of active phishing risk referencing OAuth consent prompts.

Patch Information

No vendor patch reference is available in the enriched CVE data at the time of publication. Track the GitHub Issue Discussion and the Webasyst Forum Security Alert for a fixed release and apply it to every affected deployment.

Workarounds

• Implement a reverse proxy or WAF rule that validates the redirect_uri parameter on OAuth authorization requests against a strict allowlist of registered callback URLs.
• Disable or restrict any OAuth client applications that are not actively required for business operations.
• Enforce exact string matching for redirect_uri values at the application boundary and reject requests containing wildcards, path traversal segments, or encoded characters that bypass validation.

# Example nginx snippet enforcing an allowlist of redirect_uri values
# on the Webasyst OAuth authorization endpoint
location /oauth.php {
    if ($arg_redirect_uri !~* "^https://(app1\.example\.com|app2\.example\.com)/callback$") {
        return 400 "Invalid redirect_uri";
    }
    proxy_pass http://webasyst_backend;
}