CVE-2026-82378: Apache Roller OAuth 1.0a Auth Bypass Vulnerability

CVE-2026-82378 Overview

CVE-2026-82378 is an incorrect authorization vulnerability [CWE-863] in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session. An unauthenticated remote attacker who learns an outstanding OAuth 1.0a request token for a site-wide consumer can bind that token to any user account, including an administrator. Exploitation requires only an unsigned authorization request. Apache Roller 6.1.6 fixes the issue by binding authorization to the logged-in session.

Critical Impact

Attackers can hijack OAuth 1.0a request tokens to gain administrator-level API access on affected Apache Roller instances without authentication.

Affected Products

• Apache Roller 6.1.5 (installations configured with an OAuth 1.0a site-wide consumer)
• Earlier Apache Roller releases with the same OAuth 1.0a authorization flow
• Fixed in Apache Roller 6.1.6 and later

Discovery Timeline

• 2026-09-28 - CVE CVE-2026-82378 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-82378

Vulnerability Analysis

Apache Roller implements OAuth 1.0a to let third-party applications obtain delegated access through a site-wide consumer. The three-legged flow requires a user to authenticate, approve an outstanding request token, and then exchange it for an access token. In Apache Roller 6.1.5, the authorization endpoint accepts the authorizing user identity from a value supplied in the request itself. The endpoint does not validate that this identity matches the authenticated session principal. An attacker who knows an outstanding request token can therefore submit an unsigned authorization request that binds the token to any account, including administrative users. The resulting access token grants API privileges equivalent to the targeted account.

Root Cause

The root cause is a broken access control pattern classified under [CWE-863]. Trust decisions rely on client-controlled parameters rather than server-side session state. Because authorization binding is derived from request input, the server cannot distinguish an approval performed by the token owner from one forged by an external party. The fix in Roller 6.1.6 ties authorization to the authenticated HTTP session, which prevents identity substitution.

Attack Vector

Exploitation requires network access to the Roller OAuth 1.0a authorization endpoint and knowledge of an outstanding request token belonging to the site-wide consumer. The attacker submits an unsigned authorization request that specifies an administrator (or other target) as the authorizing identity. After the request token is upgraded to an access token through the standard OAuth 1.0a exchange, the attacker obtains delegated API access as that user. No credentials, interaction, or signed request are required. The complexity of the attack is driven by the need to obtain or predict a valid outstanding request token.

No verified proof-of-concept code is published. See the Apache Roller pull request #165 and the Apache mailing list advisory for the patched code paths.

Detection Methods for CVE-2026-82378

Indicators of Compromise

• Access log entries hitting the OAuth 1.0a authorization endpoint without a valid authenticated session cookie or with a session that differs from the authorizing user parameter.
• OAuth access tokens issued for administrator accounts that were not initiated by that administrator's browser session.
• New or unexpected site-wide consumer activity, especially API calls performed under administrator identities shortly after a token exchange.

Detection Strategies

• Correlate authorization endpoint requests with authenticated session identifiers and alert when the request-supplied user does not match the session principal.
• Monitor the OAuth token lifecycle for request tokens that are authorized without a preceding interactive login by the target user.
• Review Roller audit logs for administrative API actions originating from OAuth-issued tokens rather than direct admin sessions.

Monitoring Recommendations

• Forward Roller application and web server logs to a centralized analytics platform and build detections on OAuth authorization anomalies.
• Enable alerts on creation of new OAuth access tokens tied to privileged accounts.
• Track outbound API usage of site-wide consumers for sudden privilege or volume changes.

How to Mitigate CVE-2026-82378

Immediate Actions Required

• Upgrade Apache Roller to version 6.1.6 or later, which binds authorization to the logged-in session.
• Inventory Roller installations and identify any site-wide OAuth 1.0a consumers; disable consumers that are not required.
• Revoke and reissue all outstanding OAuth 1.0a request and access tokens, especially those tied to administrator accounts.

Patch Information

The fix is included in Apache Roller 6.1.6. The patch rewrites the authorization endpoint so that the authorizing identity is derived from the authenticated HTTP session rather than from a request parameter. See the Apache Roller GitHub pull request #165 for the code change and the OSS-Security announcement for the vendor advisory.

Workarounds

• If upgrading immediately is not possible, remove or disable the OAuth 1.0a site-wide consumer configuration so the vulnerable code path is not exposed.
• Restrict network access to the Roller OAuth authorization endpoint using a reverse proxy or web application firewall rule that enforces authenticated session cookies.
• Rotate administrator credentials and audit OAuth token stores for unexpected grants until the patched version is deployed.

# Example: disable the OAuth 1.0a site-wide consumer in roller-custom.properties
oauth.enabled=false
# Then restart the Roller application server to apply the change