November 14, 2026

CVE Watchtower

CVE-2026-101274pretix

NVD

Vulnerability Summary

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.
Severity Level
MEDIUM(6.9)
Published Date
Oct 28, 2026
Last Modified
Nov 5, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.37%Probability
Root Weakness (CWE)
N/A
CVSS v4.0 Base Metrics — Score 6.9 (MEDIUM)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsPresent
Privileges RequiredHigh
User InteractionPassive
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)Low
Availability (Vulnerable System)None
Confidentiality (Subsequent System)High
Integrity (Subsequent System)None
Availability (Subsequent System)None

Affected & Patched Versions

Affected Versions
  • pretix < 2026.6.4
  • pretix >= 2026.7.0 and < 2026.7.3
  • pretix >= 2026.8.0 and < 2026.8.1
Patched Versions
  • pretix 2026.6.4
  • pretix 2026.7.3
  • pretix 2026.8.1

What to do

Fix it during your normal patch cycle. No exploitation is confirmed yet.

  1. Check whether you run pretix and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Oct 28, 2026Published
  • Nov 5, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new pretix CVEsYou are reading CVE-2026-101274. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

More pretix CVEs

External References

Data last checked: Nov 14, 2026 01:09 UTC