CVE-2026-90882: Open VSX Registry CSRF Vulnerability

CVE-2026-90882 Overview

CVE-2026-90882 is a Cross-Origin Resource Sharing (CORS) misconfiguration [CWE-942] affecting the open-vsx.org deployment. The edge layer reflected the requesting Origin header while also emitting Access-Control-Allow-Credentials: true on authenticated /user/ endpoints. Any attacker-controlled page could issue credentialed requests against the service in a logged-in user's browser and read the responses. Because /user/csrf was readable through the same channel, the CSRF protection on write endpoints could be bypassed, allowing an attacker to call /user/token/create and exfiltrate a personal access token with publish and delete rights over the victim's namespaces.

Critical Impact
Attackers can steal Open VSX personal access tokens from any logged-in user who visits a malicious page, gaining publish and delete rights over the victim's extension namespaces.

Affected Products

Eclipse Open VSX Registry (open-vsx.org deployment)
Authenticated /user/ API endpoints served through the CDN/edge layer
Downstream namespaces and extensions owned by authenticated users

Discovery Timeline

2026-09-22 - CVE-2026-90882 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-90882

Vulnerability Analysis

The flaw stems from the CDN/edge layer emitting permissive CORS headers on authenticated endpoints. When a browser sent a credentialed request to /user/, /user/tokens, /user/namespaces, /user/extensions, /user/search/{name}, or /user/namespace/{name}/members, the response reflected the request's Origin header and set Access-Control-Allow-Credentials: true. The Same-Origin Policy no longer isolated the responses. An attacker page could read login name, avatar, homepage, tokens URL, existing tokens metadata, namespace membership, and extension inventory.

The write path was reachable through the same weakness. The /user/csrf endpoint returned a valid CSRF token to any origin, defeating the site's CSRF protection. Chaining the two primitives, an attacker page could call /user/token/create with a valid CSRF value and read the newly issued personal access token from the response body. That token carries publish and delete privileges across the victim's namespaces, enabling supply chain attacks against consumers of the affected extensions.

Root Cause

The Open VSX application configures allowCredentials(true) in exactly one place, bound to a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. The permissive origin reflection was introduced by the CDN/edge layer in front of the application, not by the software itself. No configuration of the Open VSX server produces the observed behavior.

Attack Vector

Exploitation requires only that a victim with an active Open VSX session visit a page controlled by the attacker. The malicious page uses fetch() with credentials: 'include' to read /user/csrf, then POSTs to /user/token/create with the retrieved CSRF value. The response body containing the personal access token is readable because the edge layer echoes the attacker's Origin and allows credentials.

The vulnerability is described in prose only; no verified proof-of-concept code is published. See the Eclipse Security CVE Assignment for the coordinating advisory.

Detection Methods for CVE-2026-90882

Indicators of Compromise

Unexpected POST /user/token/create requests followed by immediate use of the new token from a different IP or user agent
Personal access tokens appearing in a user's /user/tokens list that the account owner did not create
Extension publish or delete operations against namespaces that do not match the owner's normal release cadence
HTTP responses from /user/ endpoints where Access-Control-Allow-Origin reflects an arbitrary third-party origin

Detection Strategies

Inspect edge and CDN logs for cross-origin credentialed requests to /user/ paths originating from Referer values outside ovsx.webui.url
Baseline token creation events per account and alert on tokens created outside normal browser sessions or workflows
Correlate /user/csrf reads with subsequent /user/token/create calls that occur within seconds and from the same client fingerprint

Monitoring Recommendations

Enable audit logging on all namespace publish and delete actions and forward the events to a centralized analytics platform
Alert account owners on new token issuance, IP or geolocation changes, and first-use of newly minted tokens
Continuously verify that edge responses on authenticated paths do not reflect arbitrary Origin values with Access-Control-Allow-Credentials: true

How to Mitigate CVE-2026-90882

Immediate Actions Required

Rotate every personal access token issued through open-vsx.org and review the tokens list for entries the account owner did not create
Audit recent publish and delete activity on owned namespaces and roll back unauthorized extension versions
Force re-authentication of active sessions and invalidate long-lived cookies
Review the Eclipse Security CVE Assignment for coordinated remediation guidance

Patch Information

The misconfiguration was in the CDN/edge layer of the open-vsx.org deployment rather than the Open VSX software. Operators of the public registry are responsible for correcting the edge CORS policy. Self-hosted Open VSX instances are not affected by default because the application only allows credentials on the single origin defined by ovsx.webui.url. Confirm remediation status through the linked Eclipse advisory.

Workarounds

Restrict Access-Control-Allow-Origin at the CDN/edge to the exact value of ovsx.webui.url and never emit origin reflection with Access-Control-Allow-Credentials: true
Deny cross-origin credentialed access to /user/, /user/csrf, and /user/token/* at the edge
Shorten personal access token lifetime and scope tokens to the minimum publish or delete rights required
Require additional confirmation, such as re-authentication, before issuing new tokens through /user/token/create