An attacker can craft a link that injects an attacker‑controlled OIDC authority into the Eclipse Ditto Explorer UI. When autoSso is enabled the UI automatically initiates a login with a legitimate identity provider, but the returned authorization code is then exchanged, along with the PKCE code_verifier, at the attacker’s token endpoint. This allows the attacker to redeem the code for bearer, access and refresh tokens belonging to the victim, thereby enabling account takeover. Additionally, an attacker‑controlled api_uri can cause the UI to send the victim’s bearer token or Basic credentials directly to the attacker, providing another avenue for credential theft.

Eclipse Ditto Ditto Explorer UI versions 3.6.0 through 3.9.7 are affected. The vulnerability arises from an unvalidated environment URL configuration that is persisted across sessions, allowing repeated token theft without a new crafted link.

The CVSS score of 7.1 indicates high severity. EPSS data is not available, although the lack of a KEV listing suggests no publicly known exploit has been reported yet. The likely attack vector is remote, relying on a user clicking a malicious link that activates autoSso. Given the persistence of the configuration, continued exposure is possible if the UI is reused without intervention.