CVE-2026-101274 Details
Description
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.
A vulnerability exists in Pretix when used as an identity provider for Single-Sign-On (SSO) customer accounts. The system fails to properly validate the 'response_type' in authorization requests against the SSO client's configured grant type. This flaw allows an SSO client, set to accept only the 'code' response type, to incorrectly receive a valid token by sending an 'id_token' response type instead. Exploitation requires the attacker to execute JavaScript on the page indicated by the 'redirect_uri', which must be pre-approved in the client configuration.
Users are advised to update to Pretix versions 2026.8.1, 2026.7.3, or 2026.6.4, all of which address this vulnerability. For those using the Pretix Hosted service, the update has already been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://pretix.eu/about/en/blog/20261028-release-2026-8-1/ | rami.io | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pretix | >= 2026, < 2026.8.1 >= 2026, < 2026.7.3 >= 2026, < 2026.6.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | rami.io |