Umbraco CMS: Authentication bypass (CVE-2026-117553)
Umbraco CMS contains an authentication bypass vulnerability involving Host header poisoning that allows unauthenticated attackers to hijack back-office sessions and execute code via Razor templates.
CVE search metadata
CVE search record: CVE-2026-117553. Severity: high. CVSS: 7.5. KEV: no. Product: Umbraco CMS (< 17.7.2), Umbraco CMS (< 18.2.2). Brief: Umbraco CMS: Authentication bypass (CVE-2026-117553). Brief link: https://feed.craftedsignal.io/briefs/2026-10-umbraco-auth-bypass/
Triage facts
Revision 1- Applicability
- Umbraco CMS (< 17.7.2), Umbraco CMS (< 18.2.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Umbraco CMS versions before 17.7.2 and 18.2.2 contain an authentication bypass vulnerability. Unauthenticated attackers can poison the Host header to register attacker-controlled OAuth redirect URIs. By sending authorization links using response_mode=form_post to signed-in users, attackers can capture authorization codes. These codes can be redeemed via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.