CVE-2026-91201: DocsGPT OAuth Authentication Bypass Flaw

CVE-2026-91201 Overview

CVE-2026-91201 affects DocsGPT through version 0.20.0, an open-source documentation assistant. The application posts OAuth (Open Authorization) connector session tokens to a wildcard target origin in the callback-status endpoint without validating the sender origin. Attackers who act as window.opener during OAuth authorization can capture session tokens and provider account emails. Captured tokens allow adversaries to disconnect victims' cloud storage connectors. The flaw is categorized under CWE-346: Origin Validation Error.

Critical Impact

Unauthenticated network attackers with user interaction can steal OAuth session tokens and provider account emails, then abuse those tokens to disconnect victim cloud storage connectors.

Affected Products

• DocsGPT versions through 0.20.0
• DocsGPT OAuth connector callback-status endpoint (docsgpt/api/connector/routes.py)
• DocsGPT frontend ConnectorAuth React component

Discovery Timeline

• 2026-09-14 - CVE-2026-91201 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-91201

Vulnerability Analysis

DocsGPT implements OAuth connectors that authorize the application to access third-party cloud storage on behalf of a user. During the OAuth callback flow, the backend returns session state to the frontend, which relays it to the parent window using the browser postMessage API. The frontend calls postMessage with "*" as the target origin, so any window that opened the OAuth popup can receive the message. The backend endpoint that emits this payload does not validate where the message will be delivered, and the frontend does not verify the sender origin when receiving it.

The exposed payload includes the OAuth session token issued to the connector along with the provider account email address. An attacker who tricks a user into launching the OAuth flow from an attacker-controlled page becomes the window.opener for the popup. When DocsGPT posts the callback-status message with a wildcard origin, the attacker page receives the token directly. See the VulnCheck advisory on DocsGPT for the full disclosure.

Root Cause

The root cause is missing origin validation on both ends of a cross-window message. The frontend ConnectorAuth.tsx component invokes window.opener.postMessage(payload, "*") instead of restricting the target origin to the trusted DocsGPT UI. The backend routes in docsgpt/api/connector/routes.py return the session token in the callback-status response without checking that the recipient window belongs to the same origin. This combination allows any framing or opener context to intercept the credential.

Attack Vector

The attack requires user interaction. An attacker hosts a page that opens the DocsGPT OAuth authorization URL through window.open. The victim, already authenticated to the OAuth provider, completes the consent screen. DocsGPT then posts the callback-status message containing the OAuth session token to "*", delivering it to the attacker's opener window. The attacker uses the token to call DocsGPT connector APIs and disconnect the victim's cloud storage integration. The vulnerability details are documented in the referenced DocsGPT connector routes and the ConnectorAuth component source.

Detection Methods for CVE-2026-91201

Indicators of Compromise

• Unexpected disconnection of cloud storage connectors from DocsGPT user accounts without a corresponding user action.
• Web server logs showing OAuth callback traffic originating from browsers that were referred by third-party or unknown domains.
• Duplicate connector authorization events for the same provider account within a short window from different client IPs or user agents.

Detection Strategies

• Review DocsGPT frontend bundles for postMessage calls that use "*" as the target origin, specifically inside ConnectorAuth.tsx.
• Audit backend connector/routes.py handlers to confirm whether OAuth session tokens are emitted in callback-status responses without recipient origin checks.
• Monitor application logs for disconnect actions on OAuth connectors that immediately follow a callback-status response from a new session.

Monitoring Recommendations

• Enable audit logging for all OAuth connector lifecycle events (connect, callback, disconnect) and forward to a central log store for correlation.
• Alert on OAuth callback flows where the HTTP Referer or Origin header does not match the trusted DocsGPT UI domain.
• Track anomalous rates of connector disconnect events per user or per provider account.

How to Mitigate CVE-2026-91201

Immediate Actions Required

• Restrict access to DocsGPT instances behind authenticated network controls until a patched release is deployed.
• Instruct users to avoid initiating DocsGPT OAuth connector flows from links or pages that are not the trusted DocsGPT UI.
• Rotate any OAuth tokens issued to DocsGPT connectors that may have been exposed and review provider-side activity logs for unauthorized use.

Patch Information

At the time of publication, no vendor-fixed release is referenced in the NVD entry. Track the upstream DocsGPT GitHub project and DocsGPT Issue #2766 for a patched version and apply it as soon as it becomes available. Consult the VulnCheck advisory for mitigation guidance specific to the release cadence.

Workarounds

• Modify the frontend ConnectorAuth component to call postMessage with an explicit target origin that matches the DocsGPT UI, replacing the wildcard "*".
• Add a sender origin check in the parent window's message event listener to reject any message whose event.origin is not the trusted DocsGPT domain.
• Remove OAuth session tokens from callback-status responses and instead deliver them via a same-origin, authenticated backend fetch keyed to the initiating session.
• Deploy a strict Content Security Policy (frame-ancestors 'self') and Cross-Origin-Opener-Policy: same-origin header to reduce cross-window opener abuse.

# Configuration example: recommended response headers for the DocsGPT frontend
# Apply at the reverse proxy (for example, Nginx) that serves the DocsGPT UI
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'" always;