CVE-2026-24772

OpenProject CVE-2026-24772 affects OpenProject 17.0.0 to 17.0.1 where a synchronization server token is decrypted and misused due to the synchronization server not validating the backend URL. The backend generates a 24-hour authentication token, encrypted with a shared secret, which the frontend ...