Apache Allura implements OAuth1 for user authentication. An improper callback validation flaw allows an attacker to supply a malicious callback URL during the OAuth flow, potentially stealing authentication tokens or redirecting users to harmful sites. The vulnerability is a classic reflection of the CWE‑601 weakness, where an unvalidated redirect or forward can be exploited for phishing or credential compromise.

The issue affects all versions of Apache Allura up to and including 1.21.0. The product is developed by the Apache Software Foundation under the Allura project name. Users running any Allura instance up to version 1.21.0 should consider the version as impacted.

The CVSS score is 9.1 and the EPSS score is < 1%, indicating an exploitation probability of less than 1%. The vulnerability is not listed in the CISA KEV catalog. While the lack of exploitation data makes it difficult to quantify risk precisely, the absence of known exploits suggests a lower likelihood of active attacks at this time. Nevertheless, because the flaw can lead to credential theft and phishing, it warrants timely patching once an appropriate update becomes available.