Read the docs
TI-2026-33510 Aliases CVE-2026-45773GHSA-hcf7-66rw-9f5r

Turborepo: Login callback CSRF/session fixation

Priority LOW 22CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering, Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-384.

Summary

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00124 2nd percentileScored 2026-11-07
Fix Fixed turborepo (vercel): 2.9.14turbo (npm): 2.9.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelturborepobefore 2.9.142.9.14Patch availableCNA
—turbo (npm)before 2.9.142.9.14Patch availableGHSA-hcf7-66rw-9f5r
  • turborepo Vendorvercel Affected before 2.9.14 Fixed in 2.9.14 Patch available CNA
  • turbo (npm) Vendor— Affected before 2.9.14 Fixed in 2.9.14 Patch available GHSA-hcf7-66rw-9f5r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:*before 2.9.14Vulnerablevercel
  • cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:* Versions before 2.9.14 Vulnerable ·vercel

Remediation

  • Fix · CNA turborepo (vercel) Fixed in 2.9.14
  • Fix · GHSA-hcf7-66rw-9f5r turbo (npm) Fixed in 2.9.14 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45773
  2. 2026-10-03 Alias added: GHSA-hcf7-66rw-9f5r

References

Advisory 2

Other 1

  • TI-2026-33509 Turborepo: Unexpected local code execution during Yarn Berry detection CVSS 4.0N/A 0.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences