CVE-2026-13543

MEDIUM

Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-374551 | Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication
https://vuldb.com/vuln/374551
Signature, Permissions Required signature permissions-required
VDB-374551 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/374551/cti
Third Party Advisory third-party-advisory
CVE-2026-13543 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-13543
Third Party Advisory third-party-advisory
Submit #842579 | documenso v2.11.0 Authentication Bypass
https://vuldb.com/submit/842579

Scores

CVSS v3 5.6
EPSS 0.0036
EPSS Percentile 29.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-287
Status published
Products (12)
None/Documenso 2.0
None/Documenso 2.1
None/Documenso 2.10
None/Documenso 2.11.0
None/Documenso 2.2
None/Documenso 2.3
None/Documenso 2.4
None/Documenso 2.5
None/Documenso 2.6
None/Documenso 2.7
... and 2 more
Published Jun 29, 2026
Tracked Since Jun 29, 2026