CVE-2026-63373: draw.io OAuth Authentication Bypass Vulnerability

CVE-2026-63373 Overview

draw.io is a configurable diagramming and whiteboarding application widely deployed for cloud and on-premises collaboration. CVE-2026-63373 describes a Cross-Site Request Forgery [CWE-352] weakness in the OAuth callback handler located at src/main/java/com/mxgraph/online/AbsAuth.java. When the IS_GAE flag evaluates to false, the handler skips comparison of stateToken and cookieToken, removing the state binding that normally links an OAuth response to the initiating browser session. Self-hosted Docker and WAR deployments prior to version 30.2.7 are affected. The flaw allows an attacker to bind a victim's draw.io session to attacker-controlled cloud-storage credentials.

Critical Impact
A victim visiting an attacker-crafted callback URL can unknowingly authenticate their draw.io session as the attacker's identity across Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations, resulting in session integrity loss and misattribution of cloud-storage actions.

Affected Products

draw.io self-hosted Docker deployments prior to version 30.2.7
draw.io WAR deployments prior to version 30.2.7
draw.io integrations for Google Drive, OneDrive, GitHub, GitLab, and Dropbox

Discovery Timeline

2026-09-21 - CVE-2026-63373 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63373

Vulnerability Analysis

The OAuth 2.0 specification requires a state parameter to bind an authorization response to the browser session that initiated the request. draw.io normally implements this binding by generating a stateToken and a matching cookieToken, then comparing them when the provider redirects back to the callback endpoint. The shared handler in AbsAuth.java conditionally enforces this comparison based on the IS_GAE runtime flag. When IS_GAE is false, which is the default for self-hosted Docker and WAR builds, the comparison is skipped entirely. The callback therefore accepts any code presented to it, regardless of which session initiated the flow.

Root Cause

The root cause is missing state-parameter validation in a code path gated by deployment mode. The shared handler assumes state enforcement is only required on Google App Engine deployments, leaving Docker and WAR builds without CSRF protection on the OAuth callback endpoint.

Attack Vector

An attacker initiates the OAuth flow against their own cloud-storage account and captures the resulting authorization code. The attacker then constructs a callback URL containing that code and induces a victim to visit it, for example through phishing or an embedded link. The victim's draw.io session completes the token exchange and becomes authenticated as the attacker's cloud-storage identity. Any files the victim subsequently saves are written to the attacker's storage account. The identity binding does not grant the attacker access to the victim's existing cloud files, but it does allow exfiltration of new content and misattribution of activity.

text

// Security patch reference - draw.io 30.2.7 ChangeLog entry
+30-JUN-2026: 30.2.7
+
+- Removes unused package lock to prevent false positive security alerts
+- Replace Workbox CLI service-worker generation with an in-build Java helper
+- [additional feature and bug fixes bundled in the 30.2.7 release]

Source: GitHub Commit 650fbd742814

Detection Methods for CVE-2026-63373

Indicators of Compromise

OAuth callback requests to /google, /onedrive, /github, /gitlab, or /dropbox endpoints that arrive without a preceding authorization-initiation request from the same client session.
Callback requests where the state parameter is absent, empty, or does not match any recently issued cookieToken for the requesting browser.
draw.io sessions that suddenly reference cloud-storage identities inconsistent with the authenticated user account or historical usage.

Detection Strategies

Correlate Referer headers and session cookies on OAuth callback requests to identify flows initiated outside the application.
Alert on cloud-storage write operations performed by draw.io service accounts that target external tenants or unfamiliar OAuth client IDs.
Review web server access logs for repeated callback URLs sharing an identical authorization code, which suggests replay against multiple victims.

Monitoring Recommendations

Ingest draw.io application and reverse-proxy logs into a centralized analytics platform and retain OAuth callback traffic for at least 90 days.
Monitor cloud-storage audit logs from Google Drive, OneDrive, GitHub, GitLab, and Dropbox for uploads originating from unexpected user identities.
Track version metadata reported by draw.io containers to confirm all instances have been upgraded to 30.2.7 or later.

How to Mitigate CVE-2026-63373

Immediate Actions Required

Upgrade all self-hosted draw.io Docker and WAR deployments to version 30.2.7 or later.
Invalidate active draw.io sessions and revoke existing OAuth tokens issued to the application for Google Drive, OneDrive, GitHub, GitLab, and Dropbox.
Notify users to verify that recent diagrams were saved to their own cloud accounts rather than an attacker-controlled destination.

Patch Information

The fix is included in draw.io v30.2.7. The corrective commit restores unconditional comparison of stateToken and cookieToken in AbsAuth.java, removing the IS_GAE gating. Full details are documented in GHSA-mcj5-3pww-7g49.

Workarounds

Restrict access to the draw.io instance behind an authenticating reverse proxy that enforces per-session origin and referrer checks on OAuth callback routes.
Temporarily disable OAuth integrations for Google Drive, OneDrive, GitHub, GitLab, and Dropbox until the upgrade to 30.2.7 is complete.
Segment the draw.io deployment so that its OAuth callback endpoints are not reachable from arbitrary external networks.

bash

# Upgrade self-hosted draw.io Docker deployment to the patched release
docker pull jgraph/drawio:30.2.7
docker stop drawio && docker rm drawio
docker run -d --name drawio -p 8080:8080 -p 8443:8443 jgraph/drawio:30.2.7