CVE-2026-107503Published

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-107503

Published

Ditto Explorer UI

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Eclipse Ditto",
                    "product": "Ditto Explorer UI",
                    "repo": "https://github.com/eclipse-ditto/ditto",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.6.0",
                            "lessThan": "3.8.14",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.9.0",
                            "lessThan": "3.9.8",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON