{"schema":"threatline.record/2","record":{"id":"CVE-2026-111622","aliases":[],"summary":"smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri","details":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.","categories":["Unclassified"],"product":"smart-sso","vendor":"a466350665","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111622","source_modified_at":"2026-10-16T19:29:48.555Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"smart-sso","vendor":"a466350665","versions":[{"version":"0","lessThanOrEqual":"2.1.1","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.6,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00429,"percentile":0.36079,"score_date":"2026-10-23"},"published_at":"2026-10-16T17:38:58.736Z","modified_at":"2026-10-16T19:29:48.555Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111622","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T19:29:48.555Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111622","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/a466350665/smart-sso/blob/2.1.1/smart-sso-server/src/main/java/com/smart/sso/server/controller/LoginController.java#L53-L63","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/LoginController.java#L50-L59","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/Oauth2Controller.java#L55-L84","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/a466350665/smart-sso","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/smart-sso-through-2.1.1-oauth2-authorization-code-theft-via-unvalidated-redirecturi","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-16T19:29:03.823422Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T19:29:48.555Z","content_hash":"c1dd3ef7baebbf3a83bf7a0e409108d5c2d9db123211426a8cb381c14ec85a81"}}