CVE-2026-53501: Thumbor Auth Bypass Vulnerability

CVE-2026-53501 Overview

CVE-2026-53501 is a signature validation bypass in Thumbor, an open-source photo thumbnail service maintained by globo.com. Versions prior to 7.8.0 remove the HMAC signature from the request URL using Python's str.replace() before performing validation. Because str.replace() substitutes every occurrence of the substring, an attacker can inject the signature multiple times into the URL and steer which portion is validated versus which portion is fetched. This desynchronization enables loading images from unintended domains or paths that were never signed. The issue is fixed in Thumbor 7.8.0 and is classified under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
An unauthenticated network attacker can bypass HMAC URL signing in Thumbor to fetch and transform images from arbitrary sources, breaking the integrity guarantees the signature was meant to enforce.

Affected Products

Thumbor versions prior to 7.8.0
Deployments relying on HMAC URL signing for access control
Applications embedding Thumbor as a signed image transformation service

Discovery Timeline

2026-07-31 - CVE-2026-53501 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-53501

Vulnerability Analysis

Thumbor authenticates image transformation requests by prepending an HMAC signature to the URL path. Before validating the remainder of the URL, the handler strips the signature using Python's str.replace(url_signature, ""). The replacement is unbounded and replaces every match anywhere in the string, not just the prefix. An attacker who embeds the signature a second time inside the resource path causes the validator to operate on a shortened URL while Thumbor fetches the original one.

The result is a validated string that differs from the actual resource requested. The signature is genuine, but it authorizes a URL that the server never actually processes at fetch time. This allows attackers to redirect image loading to unintended domains, bypass allowed-source restrictions, or point at internal paths.

Root Cause

The root cause is the use of a global substring replacement in thumbor/handlers/imaging.py rather than an anchored prefix strip. str.replace() has no positional constraint, so any attacker-controlled occurrence of the signature substring inside the path is also removed. The validation logic assumed exactly one occurrence in a fixed prefix position, which is not enforced by the parser.

Attack Vector

Exploitation requires only network access to a Thumbor endpoint that uses HMAC URL signing. An attacker obtains any valid signature, then crafts a URL that inserts the same signature substring within the resource path so that removal of every occurrence yields a validation string matching a legitimate signed request. Thumbor then fetches the tampered path, enabling image retrieval from attacker-chosen sources.

python

            return super().compute_etag()
        return None

+    @staticmethod
+    def _strip_url_signature_prefix(url, url_signature, quoted_hash):
+        prefixes = (f"/{url_signature}/", f"/{quoted_hash}/")
+        for prefix in prefixes:
+            if url.startswith(prefix):
+                return url[len(prefix) :]
+        return url
+
    async def check_image(
        self, kwargs
    ):  # pylint: disable=too-many-return-statements

Source: Thumbor commit e3ae3e2. The patch replaces the unbounded replace() with an anchored prefix strip via str.startswith() and slicing, ensuring only the leading signature segment is removed.

Detection Methods for CVE-2026-53501

Indicators of Compromise

Thumbor request URLs where the HMAC signature token appears more than once in the path
Image fetch logs showing origin domains or paths outside the configured ALLOWED_SOURCES
HTTP 200 responses from Thumbor for resources that should have failed signature validation
Unusually long request paths containing repeated base64-like signature segments

Detection Strategies

Parse Thumbor access logs and alert on any request path containing two or more occurrences of the signature substring format
Compare the validated URL string against the actual fetched URL and flag mismatches in application telemetry
Add a WAF rule that rejects Thumbor requests whose path contains repeated 28-character URL-safe base64 tokens

Monitoring Recommendations

Forward Thumbor access and error logs to a centralized analytics platform for correlation with outbound fetch destinations
Monitor egress from Thumbor workers for connections to domains outside the intended allow list
Track the deployed Thumbor version across your fleet and alert on any instance running below 7.8.0

How to Mitigate CVE-2026-53501

Immediate Actions Required

Upgrade Thumbor to version 7.8.0 or later on all instances
Audit ALLOWED_SOURCES configuration and restrict it to the minimum set of trusted origins
Rotate the SECURITY_KEY used for HMAC signing after patching to invalidate any previously captured signatures
Review recent Thumbor access logs for suspicious multi-signature URLs indicating attempted exploitation

Patch Information

The fix is delivered in Thumbor release 7.8.0 via commit e3ae3e2. The patch introduces _strip_url_signature_prefix(), which uses str.startswith() and slicing to remove only the leading signature prefix instead of globally replacing every occurrence. See the GitHub Security Advisory GHSA-mw3h-qjxj-6xg9 for the vendor's disclosure.

Workarounds

Place Thumbor behind a reverse proxy or WAF that rejects requests containing repeated signature-shaped tokens in the path
Restrict ALLOWED_SOURCES to an explicit domain allow list so bypassed requests cannot reach arbitrary origins
Disable unsigned URL support and require HMAC signing for every request until the upgrade completes

bash

# Upgrade Thumbor to the patched release
pip install --upgrade 'thumbor>=7.8.0'

# Verify installed version
python -c "import thumbor; print(thumbor.__version__)"

# Rotate the signing key in thumbor.conf after upgrade
# SECURITY_KEY = 'REPLACE_WITH_NEW_STRONG_RANDOM_VALUE'