CVE-2026-45773 Details

A cross-site request forgery (CSRF) vulnerability has been identified in Turborepo versions through 2.9.13. The issue arises in self-hosted login and single sign-on (SSO) browser flows, which failed to validate a CSRF state value on the localhost callback. While the command-line interface (CLI) awaited authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If this token was accepted before the legitimate callback, the CLI could complete the login process with incorrect credentials. This vulnerability impacts users authenticating the 'turbo' CLI against self-hosted remote cache or authentication endpoints. Vercel-hosted login flows using device authorization are not affected.

Users can upgrade to Turborepo version 2.9.14 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, it is recommended to avoid browser-based self-hosted 'turbo login' or SSO flows on machines that may encounter untrusted web content during authentication. Instead, use a pre-provisioned token or environment-based authentication.