CVE-2026-42195 LOW

CVE-2026-42195: Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

Vendor Jgraph
Product drawio
Weakness CWE-601 · Open redirect
Published May 8, 2026
Last update May 13, 2026
View on NVD All CVEs

CVSS base score

3.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 13, 2026 Record updated