# CVE-2026-42195: jgraph draw.io open redirect and token leak in GitLab OAuth flow

Source: https://junglewise.ai/threats/cve-2026-42195-jgraph-draw-io-open-redirect-and-token-leak-in-gitlab-oauth-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42195 · Severity: low · CVSS 3.4 · Published 2026-05-08

draw.io is a popular diagramming and whiteboarding application used for creating flowcharts and technical drawings. A vulnerability in how the application handles GitLab login links allows attackers to redirect users to a malicious website instead of the official GitLab login page. This could lead to users unknowingly entering their credentials into a fake site or having their session tokens stolen, potentially compromising their accounts.

## Quick answers

**Is CVE-2026-42195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42195 being exploited in the wild.

**How severe is CVE-2026-42195?** Low severity, with a CVSS score of 3.4, published 8 May 2026.

**Which products and versions are affected?** JGraph Ltd Draw.Io < 29.7.9.

**Is there a fix for CVE-2026-42195?** A patch was published on 2026-04-20: Version 29.7.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42195 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42195?** Check whether you run JGraph Ltd Draw.Io at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The draw.io client fails to validate the 'gitlab' and 'gitlab-id' URL parameters before using them to construct OAuth authorization URLs. An attacker can craft a link containing a malicious URL in these parameters; when a victim clicks 'Authorize in GitLab' within the draw.io interface, the application opens a popup to the attacker-controlled host instead of the legitimate GitLab instance. This enables credential phishing via a spoofed login page and the exfiltration of the OAuth 'state' parameter, which contains a session-scoped CSRF token. Exploitation requires the victim to click a specially crafted link and interact with the authorization dialog. The issue is fixed in version 29.7.9 by requiring an explicit server-side configuration flag to allow custom GitLab URLs.

## Affected products

- jgraph draw.io < 29.7.9

## Timeline

- 2026-04-20: patched: Version 29.7.9 released
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/jgraph/drawio/issues/493](https://github.com/jgraph/drawio/issues/493)
- [https://github.com/jgraph/drawio/releases/tag/v29.7.9](https://github.com/jgraph/drawio/releases/tag/v29.7.9)
- [https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x](https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x)

## Related threats

- [jgraph draw.io XSS in Text Format panel via crafted cell label](https://junglewise.ai/threats/cve-2026-46642-jgraph-draw-io-xss-in-text-format-panel-via-crafted-cell-label)