Hubzilla versions prior to 11.4 contains a cross‑site request forgery vulnerability in the OAuth2 "/authorize" endpoint handled by Zotlabs\\Module\\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user’s account by submitting a cross‑origin POST request without a CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker‑chosen OAuth2 parameters, including client_id, client_secret, redirect_uri, and scope, to silently register a persistent application. The attacker‑controlled application can intercept future OAuth2 authorization codes when the victim authenticates against the attacker‑controlled client. The weakness is classified as CWE‑352 and the reported CVSS score is 5.1, indicating moderate severity.

Hubzilla versions prior to 11.4 distributed by the Hubzilla:Hubzilla vendor. The vulnerability resides in the core module that processes OAuth2 authorization requests within the Zotlabs/Module/Authorize.php file.

The CVSS score of 5.1 reflects moderate risk, while the EPSS score is < 1%, making precise exploitation probability unclear. Because the flaw permits CSRF without authentication, an attacker only needs to lure a logged‑in user to a crafted page that auto‑submits a POST request; no additional credentials are required. At present the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation yet, but the attack vector is straightforward enough to warrant prompt action.