The vulnerability is a request replay attack in the OAuth1 implementation of Apache Allura. Attackers who capture a valid OAuth1 signed request can resend the same request, causing the server to accept it as a new, legitimate authentication attempt. This misuse of the protocol’s lack of replay protection can grant an attacker unauthorized access to protected resources, data, or actions within the application.

Apache Allura instances built on or earlier than version 1.21.0 are susceptible. The issue is localized to the Apache Software Foundation’s Allura product and does not affect later releases beyond 1.21.0.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential for unauthorized access elevates its risk. Attackers require the ability to intercept or observe OAuth1 traffic, a capability obtainable through network sniffing or compromised intermediaries. The exploit does not require elevated privileges on the target host; a network attacker can replay captured requests directly over the application’s exposed endpoints. With a CVSS score of 9.1, the severity is high, warranting immediate attention.