OpenProject’s synchronization server in version 17.0.0 introduced an endpoint that accepts a user‑supplied backend URL without proper validation. When a client sends a request containing an encrypted authentication token, the server decrypts the token and forwards the request to the supplied URL. An attacker who can obtain an intercepted token can exploit this flaw to cause the synchronization server to decrypt the token and obtain a valid access token, effectively allowing the attacker to act on the victim’s behalf. This flaw represents a CWE‑345 server‑side request forgery and can lead to unauthorized account access and potential data leakage.

The vulnerability exists in OpenProject 17.0.0 through 17.0.1. It is resolved in 17.0.2. Affected systems are installations of the OpenProject web application and the accompanying Hocuspocus synchronization container that are configured to enable real‑time collaboration.

The CVSS score of 8.9 indicates high severity, but the EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would first need a way to obtain or guess a token, either by interception or phishing. Once the token is available, the flaw allows the server to decrypt it and use the resulting access token against the target OpenProject instance. Based on the description, the likely attack vector involves an authenticated but unauthorized user or a malicious party that can manipulate the backend URL parameter. This defers the need for higher privileges on the target system, making the exploit relatively straightforward for attackers who can gather a token.