{"id":"CVE-2026-101274","aliases":[],"title":"When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the response_type…","titleSource":"pretix","descriptionSource":"pretix","products":[{"vendor":"pretix","name":"","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026.6.4","versionType":"python"},{"version":"2026.7.0","status":"affected","lessThan":"2026.7.3","versionType":"python"},{"version":"2026.8.0","status":"affected","lessThan":"2026.8.1","versionType":"python"}],"defaultStatus":"unaffected","source":"pretix","url":"https://www.cve.org/CVERecord?id=CVE-2026-101274"}],"remediation":[],"description":"When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.","severity":"medium","score":6.9,"published":"2026-10-28T10:31:23.485Z","modified":"2026-10-28T10:31:23.485Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://pretix.eu/about/en/blog/20261028-release-2026-8-1/"],"sources":[{"name":"CVE","id":"CVE-2026-101274","modified":"2026-10-28T10:31:23.485Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-101274"}],"assessments":[{"source":"pretix","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N","score":6.9}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:35:36.012Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-28T10:45:31.335Z","attemptedAt":"2026-10-28T10:45:31.335Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T10:45:31.197Z","attemptedAt":"2026-10-28T10:45:31.197Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-28T10:45:31.197Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:45:31.335Z","attemptedAt":"2026-10-28T10:45:31.335Z"}],"evidence":[]}