{"id":"CVE-2026-45773","sourceIdentifier":"security-advisories@github.com","published":"2026-05-15T16:16:15.137","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14."},{"lang":"es","value":"Turborepo es un sistema de compilación de alto rendimiento para bases de código JavaScript y TypeScript. Antes de la versión 2.9.14, los flujos de inicio de sesión autoalojados y SSO del navegador de Turborepo no validaban un valor de estado CSRF en la devolución de llamada de localhost. Mientras la CLI esperaba la autenticación, una página web maliciosa podía enviar una solicitud al servidor de devolución de llamada local con un token controlado por el atacante. Si se aceptaba antes de la devolución de llamada legítima, la CLI podía completar el inicio de sesión con las credenciales incorrectas. Esto afecta a los usuarios que autentican la CLI de turbo contra puntos finales de caché/autenticación remotos autoalojados. Los flujos de inicio de sesión alojados en Vercel que utilizan la autorización de dispositivo no se ven afectados. Esta vulnerabilidad está corregida en la versión 2.9.14."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vercel","product":"turborepo","versions":[{"version":"< 2.9.14","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T16:44:57.841414Z","id":"CVE-2026-45773","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-384"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:turborepo:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.9.14","matchCriteriaId":"CE675260-6237-4F25-9D46-0CE006AC0DC2"}]}]}],"references":[{"url":"https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}