What’s Vulnerable › Vulnerabilities

CVE-2026-91201: DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-23
• Weakness: CWE-346

Description

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.

Affected products

• arc53 DocsGPT: through 0.20.0

References

• https://github.com/arc53/DocsGPT
• https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L344-L366
• https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/docsgpt/api/connector/routes.py#L515-L527
• https://github.com/arc53/DocsGPT/blob/c36b0af17037449f34449efa97da82becfc9492d/frontend/src/components/ConnectorAuth.tsx#L57-L80
• https://github.com/arc53/DocsGPT/issues/2766
• https://www.vulncheck.com/advisories/docsgpt-through-0.20.0-oauth-token-disclosure-via-wildcard-postmessage

Get alerted when CVE-2026-91201 or the next vulnerability affects your stack