The vulnerability is an OAuth 1 rebinding flaw in Apache Allura that allows an attacker to manipulate the OAuth binding process. This can lead to unauthorized authentication and the ability to act as another user, effectively bypassing standard access controls. The weakness is categorized as Privilege Authorization, with the CWE reference CWE-863.

Affected systems are installations of Apache Allura provided by the Apache Software Foundation, specifically any deployment running a version through 1.22.0. The vendor recommends upgrading to version 1.22.1, which contains the fix.

Exploitability is potentially high, but the EPSS score is unknown and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a web‑based interaction where an attacker changes or rebinds OAuth parameters; no special prerequisites are stated in the CVE. The absence of an EPSS rating suggests limited publicly visible exploitation, yet the flaw permits an attacker to gain unauthorized access if they can influence OAuth requests. Organizations without a timely patch remain exposed.