CVE-2026-61397

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2026-08-21

Last modified

2026-10-16

Weaknesses

CWE-200

Affected products

• Cloudstack (Apache)
• Apache Cloudstack (Apache Software Foundation)

References

• https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc