{"id":"EUVD-2026-30553","enisaUuid":"3bfae04c-3eff-3552-b4f5-9cda58157440","description":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo\u0027s self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.","datePublished":"May 15, 2026, 3:51:38 PM","dateUpdated":"May 15, 2026, 4:45:06 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","references":"https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r\n","aliases":"CVE-2026-45773\nGHSA-hcf7-66rw-9f5r\n","assigner":"GitHub_M","epss":0.12,"enisaIdProduct":[{"id":"c90bd592-0bef-32f6-b386-62298a8e2655","product":{"name":"turborepo","vendor":{"name":"vercel"}},"product_version":"\u003c 2.9.14"}],"enisaIdVendor":[{"id":"4095d128-5b84-33fb-8579-1cce07404f08","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"65d6dc52-bb3a-3d35-9a6c-a983c2767852","vulnerability":{"id":"CVE-2026-45773","description":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo\u0027s self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.","datePublished":"May 15, 2026, 3:51:38 PM","dateUpdated":"May 15, 2026, 4:45:06 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","references":"https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r\n","enisa_id":"EUVD-2026-30553\n","assigner":"GitHub_M","epss":0.12,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"80c5d5b6-99c5-391c-85d8-a2a988d6d19e","product":{"name":"turborepo","vendor":{"name":"vercel"}},"product_version":"\u003c 2.9.14"}],"vulnerabilityVendor":[{"id":"3beedd66-0610-3c9d-85e5-42ff75802325","vendor":{"name":"vercel"}}]}},{"id":"e5ded79a-392e-3d47-9429-1cec4e8b7804","vulnerability":{"id":"GHSA-hcf7-66rw-9f5r","description":"Turbo: Login callback CSRF/session fixation","datePublished":"May 19, 2026, 7:49:52 PM","dateUpdated":"Jun 29, 2026, 3:30:55 PM","baseScore":0.0,"references":"https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45773\nhttps://github.com/vercel/turborepo\n","enisa_id":"EUVD-2026-30553\n","aliases":"GHSA-hcf7-66rw-9f5r\nCVE-2026-45773\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}