CVE-2026-92120: OAuth1 replay flaw in Apache Allura fixed in version 1.22.0

What happened and what to do

The advisory, published on the oss-sec list, identifies CVE-2026-92120 as an OAuth1 request replay vulnerability in Apache Allura. According to the text, all versions up to 1.21.0 are affected, the severity is rated low, and version 1.22.0 fixes the issue. The discovery is credited to CyberLeo as reporter.

In practice, a company using Apache Allura as a code or project management platform should upgrade the instance to version 1.22.0 and record the change in its component inventory. Where OAuth1 integrations are exposed, it is worth reviewing authentication logs for repeated requests and confirming that integration credentials were rotated if misuse is suspected. An automated survey of installed versions across all servers, combined with a patch tracking dashboard, keeps older instances from going unnoticed.

How the consultancy can help

Exposure diagnosis: an inventory of Apache Allura instances, the versions in use and the active OAuth1 integrations. Then a scoped upgrade plan and continuous monitoring of versions and repeated-request patterns in authentication logs, deployed on the client's own infrastructure.

Next step

If your team uses Apache Allura, send a short description of your environment, installed versions and OAuth1 integrations in use. You will receive a scoped proposal with the diagnosis and next steps.