CVE-2026-13543 is an improper authentication vulnerability affecting Documenso versions 2.0 through 2.11.0. The flaw exists in the Google OAuth Login functionality, specifically in the handle-oauth-callback-url.ts file. This vulnerability enables remote attackers to manipulate the authentication process, potentially bypassing intended access controls. Exploitation requires high complexity and no privileges or user interaction are needed. Although an exploit is publicly available, the patch is not yet officially released, as the pull request for the fix is awaiting acceptance.

Successful exploitation can lead to improper authentication, allowing attackers to gain unauthorized access to the application. This could compromise user accounts or sensitive data protected by the Google OAuth Login mechanism. The medium CVSS score reflects the moderate risk due to the complexity of exploitation and the limited scope of impact.

No official fix or patch is currently available as the pull request for the remediation is pending acceptance. Users should monitor the vendor's repository or advisory channels for the official patch release. Until then, consider restricting access to the affected authentication endpoints or implementing additional authentication checks as a temporary measure.