CVE-2026-29782: OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2

CVE-2026-29782 · Severity: high · CVSS 7.2 · Published 2026-04-02

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

Technologies: Devcode Openstamanager, devcode-it/openstamanager (Packagist). Vendors: Devcode, Packagist.

Quick answers

Is CVE-2026-29782 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29782 being exploited in the wild.
How severe is CVE-2026-29782?
High severity, with a CVSS score of 7.2, published 2 April 2026.
Which products and versions are affected?
devcode-it/openstamanager (Packagist) ECOSYSTEM:introduced=0,fixed=2.10.2.
Is there a fix for CVE-2026-29782?
Yes. devcode-it/openstamanager (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-29782?
Check whether you run Devcode Openstamanager or devcode-it/openstamanager (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • devcode-it/openstamanager (Packagist): upgrade to 2.10.2 or later
    composer require devcode-it/openstamanager:^2.10.2

Affected products

  • Devcode Openstamanager
  • devcode-it/openstamanager (Packagist) ECOSYSTEM:introduced=0,fixed=2.10.2

Identifiers

  • CVE-2026-29782
  • GHSA-whv5-4q2f-q68g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.