CVE-2026-121728

SourceHut meta.sr.ht versions 0.56.11 through 0.89.0 are vulnerable to an authorization bypass that allows unauthenticated attackers to register accounts even when public registration is disabled. The root cause is an unchecked GraphQL RegisterAccount mutation triggered by POSTing credentials to ...

CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...