{"id":"EUVD-2026-30553","revision":"72c0ff5ddcf5441584906b20b30c2164","records":[{"revision":"72c0ff5ddcf5441584906b20b30c2164","observedAt":"2026-10-28T06:13:03.366+00:00","statement":{"source":"euvd","id":"EUVD-2026-30553","aliases":["CVE-2026-45773","GHSA-hcf7-66rw-9f5r"],"title":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was wait…","description":"Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected. This vulnerability is fixed in 2.9.14.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","score":5.1,"severity":null}],"references":["https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30553","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 15, 2026, 3:51:38 PM","dateUpdated":"May 15, 2026, 4:45:06 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30553","identifiers":["EUVD-2026-30553","CVE-2026-45773","GHSA-hcf7-66rw-9f5r"]},"retained":false,"historicalAffected":[]}],"coverage":[]}