Umbraco CMS is vulnerable to host header poisoning that allows an attacker to register a malicious OAuth redirect URI without authentication. This flaw enables the attacker to capture authorization codes sent to signed-in users, redeem those codes through HTTP Basic credentials, hijack back-office sessions, and then execute arbitrary Razor template code, effectively gaining full control over the application. The weakness is a type of open redirect side-channel and is classified as CWE-601, leading to compromise of confidentiality, integrity, and availability of the application and its data.

The vulnerability affects all releases of Umbraco CMS prior to version 17.7.2 and prior to version 18.2.2. Systems running these older editions are susceptible to unauthorized account takeover.

The CVSS score of 7.7 indicates a high severity. The EPSS value is not available, but the lack of a KEV listing does not preclude exploitation. The attack requires an unauthenticated attacker to poison the Host header and leverage the OAuth redirect URI registration feature; it typically involves a victim user who has already authenticated via OAuth so that the attacker can capture the code. Once the redirect URI is established, the attacker can hijack the back-office session and run code through Razor templates, giving them full administrative control. Because the flaw relies on host header manipulation and the OAuth workflow, it can be exercised over the network by an attacker who can send crafted requests to the site, making it a remote vulnerability with user interaction.