CVE-2026-101274Medium· 6.9▾ SunlitWhen pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the response_type requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the code response type, which requires knowledge of the client secret to use and would wrongfully send a response type like id_token, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by redirect_uri, which must be from a list specified in the client configuration.
pretix < 2026.6.4pretix >= 2026.7.0 < 2026.7.3pretix >= 2026.8.0 < 2026.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101273Medium· 5.3Giftcard enumeration
CVE-2026-101272Low· 2.3Incorrect session validation for API-created shredder exports
CVE-2026-101267Low· 2.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information
CVE-2026-101268Low· 1.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account
CVE-2026-101269Low· 2.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users
CVE-2026-101270Low· 2.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.