Hubzilla version 11.2.1 contains a CSRF vulnerability in the OAuth2 "/authorize" endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user’s account by sending a cross‑origin POST request without a CSRF token or Origin/Referer validation. Once registered, the attacker‑controlled application can silently intercept future OAuth2 authorization codes issued to the victim, potentially letting the attacker gain access to access tokens or underlying resources. The weakness is classified as CWE‑352 and the reported CVSS score is 5.1, indicating moderate severity.

The issue affects Hubzilla 11.2.1 distributed by the Hubzilla:Hubzilla vendor. The vulnerability resides in the core module that processes OAuth2 authorization requests within the Zotlabs/Module/Authorize.php file.

The CVSS score of 5.1 reflects moderate risk, while the EPSS score is not available, making precise exploitation probability unclear. Because the flaw permits CSRF without authentication, an attacker only needs to lure a logged‑in user to a crafted page that auto‑submits a POST request; no additional credentials are required. At present the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploitation yet, but the attack vector is straightforward enough to warrant prompt action.