CVE-2026-107503: CWE-15 External control of system or configuration setting in Eclipse Ditto Ditto Explorer UI

This vulnerability arises from unvalidated environment URLs in the Ditto Explorer UI, enabling attackers to inject a crafted OIDC authority when autoSso is enabled. The UI initiates login at the legitimate identity provider but exchanges the authorization code and PKCE code_verifier at an attacker-controlled token endpoint, allowing the attacker to redeem the victim's access and refresh tokens. Additionally, an attacker-controlled api_uri can cause the UI to send the victim's bearer token or Basic credentials to the attacker. The malicious configuration is persisted, leading to repeated token theft on future UI visits without requiring the crafted link again. Affected versions are from 3.6.0 up to and including 3.9.7.

Successful exploitation results in theft of OAuth tokens and credentials, enabling attackers to take over user accounts. The persistence of the malicious configuration means repeated token theft can occur without further user interaction beyond visiting the UI. This compromises user authentication and authorization, potentially exposing sensitive data and allowing unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted environment URLs and disable autoSso if possible. Monitor for suspicious token exchanges and consider restricting access to the Ditto Explorer UI. Follow vendor updates closely for patches or official mitigations.