Zurück zur CVE-Übersicht
CVE-2026-116194
MEDIUM(6.8)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Risk Signal Score17/100 — NIEDRIG
- CVSS 6.8 — Mittel
Erwähnungen (letzte 60 Tage)
Artikel
EPSS-Score
0.1%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
6.8
Technische Schwere
Beschreibung
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Betroffene Produkte
- cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*