CVE-2026-91201

EUVD-2026-78210
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
arc53docsgpt
𝑥
≤ 0.20.0
CNA
Common Weakness Enumeration
References
https://github.com/arc53/DocsGPT
https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L344-L366
https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L515-L527
https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/frontend/src/components/ConnectorAuth.tsx#L57-L80
https://github.com/arc53/DocsGPT/issues/2766
https://www.vulncheck.com/advisories/docsgpt-through-0.20.0-oauth-token-disclosure-via-wildcard-postmessage