CVE-2026-45773 describes a CSRF vulnerability in vercel turborepo's self-hosted login and SSO browser flows prior to version 2.9.14. The localhost callback did not validate the CSRF state value, enabling an attacker to send a malicious request with an attacker-controlled token while the CLI awaited authentication. If this malicious request is accepted before the legitimate callback, the CLI could authenticate with wrong credentials. This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not impacted. The issue is resolved in turborepo version 2.9.14.

An attacker controlling a malicious web page can exploit this vulnerability to cause the turborepo CLI to complete login with attacker-supplied credentials instead of the legitimate user's credentials when using self-hosted remote cache/auth endpoints. This could lead to unauthorized access or actions performed under the attacker's identity. The vulnerability does not affect Vercel-hosted login flows using device authorization.

This vulnerability is fixed in turborepo version 2.9.14. Users should upgrade to version 2.9.14 or later to remediate this issue. Since the product is self-hosted, the vendor does not manage remediation automatically. Patch status is confirmed by the vendor advisory indicating the fix in 2.9.14. No additional mitigations are specified.