CVE-2026-91201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91201
Published
2026-09-14T22:10:58Z
Modified
2026-09-25T03:30:26Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage
Details

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-346"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91201.json"
}
References

Affected packages

Git / github.com/arc53/docsgpt

Affected ranges

Type
GIT
Repo
https://github.com/arc53/docsgpt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c36b0af17037449f34449efa97da82becfc9492d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.20.0"
        },
        {
            "fixed":  "0.20.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.14.0
0.15.0
0.16.0
0.16.1
0.17.0
0.17.1
0.17.2
0.17.3
0.18.0
0.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91201.json"