CVE-2026-13543: Documenso Google OAuth Authentication Bypass Vulnerability (CVSS 5.6)

Technical summary

CVE-2026-13543 is an improper authentication vulnerability (CWE-287) located in the Google OAuth callback URL handler (packages/auth/server/lib/utils/handle-oauth-callback-url.ts) in Documenso. The flaw allows manipulation of the OAuth callback mechanism, potentially enabling authentication bypass or token interception. The attack vector is network-accessible, requires no privilege escalation, but has high attack complexity (AC:H), indicating the exploit path involves non-trivial preconditions or timing requirements. The vulnerability impacts confidentiality, integrity, and availability with low severity in each dimension, yielding a CVSS 3.1 score of 5.6 (Medium).

Business impact

An attacker exploiting this vulnerability could gain unauthorized access to Documenso instances without valid credentials, potentially compromising document signing workflows, accessing sensitive signed documents, or impersonating legitimate users. For organizations using Documenso as part of their document management or e-signature processes, this could lead to compliance violations, data breaches, or fraudulent document execution. The moderate CVSS score and high attack complexity suggest the risk is contained but not negligible, particularly in high-value document scenarios.

Affected systems

Documenso versions up to and including 2.11.0 are affected. No fixed version is explicitly confirmed in the advisory; however, a pull request addressing the issue is pending acceptance. Organizations running Documenso should verify their deployment version against the vendor's advisory to confirm exposure status and expected patch timeline.

Exploitability

The vulnerability has high attack complexity, meaning exploitation is not trivial and requires specific circumstances or sophisticated technique. However, a public exploit is now available, lowering the barrier for opportunistic attackers. The attack requires no authentication or user interaction to initiate, making it remotely exploitable by unauthenticated threat actors. While the vulnerability is technically exploitable, the high complexity suggests it is not a "one-click" attack and may require reconnaissance or precise timing.

Remediation

Organizations should prioritize upgrading Documenso to a patched version once released and confirmed. In the interim, monitor the official Documenso GitHub repository and security advisories for patch availability. Consider restricting Google OAuth login to trusted networks, implementing additional authentication layers (multi-factor authentication), or temporarily disabling OAuth login if operationally feasible while awaiting the patch.

Patch guidance

Verify the latest version available in your Documenso deployment environment. The pending pull request mentioned in the advisory will likely form the basis of the next patch release. Subscribe to Documenso's security notifications or watch the project repository for a version release that addresses handle-oauth-callback-url.ts. Test patches in a non-production environment before deployment to ensure compatibility with your document workflows and integrations.

Detection guidance

Monitor authentication logs for anomalous Google OAuth callback patterns, such as repeated failed callbacks from unusual IP addresses or suspicious User-Agent strings. Review access logs for the /auth or /oauth endpoints for unexpected request volumes or malformed callback parameters. Implement logging and alerting on the handle-oauth-callback-url.ts execution to capture any unusual manipulation attempts. Consider using WAF rules to validate OAuth callback URL structure and reject malformed requests.

Why prioritize this

This vulnerability should be treated as medium priority due to its CVSS 5.6 score, public exploit availability, and direct impact on authentication. However, the high attack complexity mitigates urgency—this is not a critical zero-day requiring emergency response. Prioritize patching within your normal maintenance window, but do not delay beyond the next scheduled release cycle once a patch is available. Organizations with strict compliance requirements around document signing should accelerate remediation.

Risk score, explained

The CVSS 3.1 score of 5.6 reflects a vulnerability with low to medium impact on confidentiality, integrity, and availability, combined with high attack complexity. The network-accessible attack vector and lack of authentication requirement elevate the score moderately, but the high complexity requirement prevents it from reaching 'High' severity. The score appropriately captures a real but contained risk: exploitable by determined attackers with public tooling, but not a trivial remote code execution or complete system compromise.

Frequently asked questions