TI-2026-81926 Aliases CVE-2026-101274 GHSA-jgpc-mvf3-4rpj

Missing response type validation in pretix SSO identity provider

LOW 31CWE-306Published 2026-10-28 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

pretix versions from 0 before 2026.6.4, from 2026.7.0 before 2026.7.3, and from 2026.8.0 before 2026.8.1 do not validate the response_type of an authorization request against the grant type configured for a single sign-on client when pretix acts as the identity provider for customer accounts. An SSO client configured to allow only the code response type receives a valid token when it requests a response type such as id_token. Exploiting this requires an attacker to run JavaScript on a page listed as a redirect_uri in the client configuration.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00372 31st percentileScored 2026-11-07

Fix Fixed pretix (pretix): 2026.6.4, 2026.7.3, 2026.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pretix	pretix	before 2026.6.4; 2026.7.0 to before 2026.7.3; 2026.8.0 to before 2026.8.1	2026.6.4, 2026.7.3, 2026.8.1	Patch available	CNA

pretix Vendorpretix Affected before 2026.6.4; 2026.7.0 to before 2026.7.3; 2026.8.0 to before 2026.8.1 Fixed in 2026.6.4, 2026.7.3, 2026.8.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:pretix:pretix::::::::	—	—	pretix

cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions — — ·pretix

Remediation

Upgrade pretix to version 2026.6.4, 2026.7.3, or 2026.8.1, depending on the release branch in use. The sources list no fixed version for pretix other than these.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA pretix (pretix) Fixed in 2026.6.4, 2026.7.3, 2026.8.1

Timeline

2026-10-28 Threatist record created from CVE-2026-101274
2026-10-28 Alias added: GHSA-jgpc-mvf3-4rpj
2026-10-30 Priority changed: MEDIUM → LOW
2026-11-05 Weakness changed · CISA ADP
2026-11-05 CISA SSVC decision points changed

References

Advisory 1

https://pretix.eu/about/en/blog/20261028-release-2026-8-1/

TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences