CVE-2026-29782

OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

Affected

devcode-it · openstamanager

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2026-04-02

Updated

2026-04-03

Proof-of-concept exploits (2)

• advisories/GHSA-whv5-4q2f-q68g
• hackerking24/CVE-2026-29782-OpenSTAManager-RCE0★ · 2026-09-08

Security advisories

• devcode-it/openstamanager/security/advisories/GHSA-whv5-4q2f-q68g
• devcode-it/openstamanager/commit/d2e38cbdf91a831cefc0da1548e02b297ae644cc

References

• CVE Record
• NVD entry

Related

• CVE-2026-30225