{"id":"CVE-2026-42195","aliases":["EUVD-2026-28833","GHSA-8x7j-m8px-7p8x"],"status":"published","title":"Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.","severity":{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00192,"percentile":0.08976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-601"],"published":"2026-05-08T21:22:40Z","modified":"2026-10-28T02:30:53Z","products":[{"vendor":"jgraph","product":"drawio"}],"references":[{"url":"https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/jgraph/drawio/issues/493","tags":["x_refsource_MISC","report"]},{"url":"https://github.com/jgraph/drawio/releases/tag/v29.7.9","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42195.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42195","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42195","title":"Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.","status":"published","published":"2026-05-08T21:22:40.678Z","modified":"2026-05-13T17:47:31.482Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-601","CWE-200"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-28833","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.","status":"published","published":"2026-05-08T21:22:40Z","modified":"2026-05-13T17:47:31Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:04:33.260537Z"}],"nvd":[{"id":"CVE-2026-42195","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.","status":"published","published":"2026-05-08T22:16:31.41Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200","CWE-601"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-42195","title":"Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host","description":"draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's \"Authorize in GitLab\" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.","status":"published","published":"2026-05-08T21:22:40.678Z","modified":"2026-10-28T02:30:53.485045667Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-601"],"updated_at":"2026-11-02T15:45:04.117819Z"}]}}