Is CVE-2026-101274 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101274 being exploited in the wild.

How severe is CVE-2026-101274?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Pretix all currently supported versions before 2026.6.3, 2026.7.3, 2026.8.1.

Is there a fix for CVE-2026-101274?

Yes: fixed in pretix 2026.8.1, 2026.7.3, 2026.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101274 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101274?

Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101274: pretix improper validation of OpenID Connect response_type in SSO

CVE-2026-101274 · Severity: info · Published 2026-10-28

pretix is a ticket sales platform that can act as a Single-Sign-On identity provider for customer accounts. When configured to allow only certain authorization flows, pretix failed to properly validate which response types were allowed, potentially allowing attackers to obtain tokens they should not be able to use. This requires the attacker to inject malicious code into a trusted redirect URL and targets only user personal information (name, email, phone), not order or payment data.

Technologies: Pretix. Vendors: Pretix.

Quick answers

Is CVE-2026-101274 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101274 being exploited in the wild.
How severe is CVE-2026-101274?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Pretix all currently supported versions before 2026.6.3, 2026.7.3, 2026.8.1.
Is there a fix for CVE-2026-101274?: Yes: fixed in pretix 2026.8.1, 2026.7.3, 2026.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101274 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101274?: Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: pretix 2026.8.1, 2026.7.3, 2026.6.3

Technical details

pretix did not validate the requested response_type against the configured grant types for SSO clients, allowing a client restricted to the code flow to also receive id_token responses. Exploitation requires the attacker to execute JavaScript on the redirect_uri domain (which must be in the client's allowlist), making this a secondary vulnerability that depends on an XSS or similar flaw on a third-party site integrating pretix SSO. The vulnerability only exposes user profile data, not order or payment information.

Affected products

pretix pretix all currently supported versions before 2026.6.3, 2026.7.3, 2026.8.1

Timeline

2026-10-28: disclosed
2026-10-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.