The vulnerability in Hubzilla 11.2.1 resides in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post(). Due to missing CSRF token verification and lack of Origin/Referer header validation, attackers can perform cross-site request forgery attacks. This allows them to silently register OAuth2 applications under the victim's account by submitting attacker-chosen parameters such as client_id, client_secret, redirect_uri, and scope. The persistent OAuth2 application created can intercept authorization codes when the victim later authenticates, posing a risk to OAuth2 authorization integrity.

An attacker can register arbitrary OAuth2 applications under an authenticated user's account without their consent. This can lead to interception of OAuth2 authorization codes issued to the victim, potentially compromising OAuth2 authorization flows. However, the vulnerability does not directly disclose user data or allow privilege escalation. The CVSS score of 4.3 reflects a moderate impact primarily on integrity.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about cross-origin requests and consider implementing additional CSRF protections or monitoring OAuth2 application registrations if possible.