VYPR
← All advisories
High severity7.2NVD Advisory· Published Apr 2, 2026· Updated Apr 7, 2026

CVE-2026-29782

CVE-2026-29782

Description

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
devcode-it/openstamanagerPackagist
< 2.10.22.10.2

Affected products

1

Patches

1
d2e38cbdf91a

fix: Remote Code Execution via Insecure Deserialization in OAuth2

https://github.com/devcode-it/openstamanagervalentinaMar 5, 2026via ghsa
commit
1 file changed · +2 −2
  • src/Models/OAuth2.php+2 −2 modified
    @@ -148,7 +148,7 @@ public function getAccessToken()
     {
         $this->checkTokens();
 
-        return $this->attributes['access_token'] ? unserialize($this->attributes['access_token']) : null;
+        return $this->attributes['access_token'] ? unserialize($this->attributes['access_token'], ['allowed_classes' => [AccessToken::class]]) : null;
     }
 
     /**
@@ -190,7 +190,7 @@ protected function updateTokens($access_token, $refresh_token)
      */
     protected function checkTokens()
     {
-        $access_token = $this->access_token ? unserialize($this->access_token) : null;
+        $access_token = $this->access_token ? unserialize($this->access_token, ['allowed_classes' => [AccessToken::class]]) : null;
 
         if (!empty($access_token) && $access_token->hasExpired()) {
             // Tentativo di refresh del token di accesso

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.