Executive brief
draw.io is a diagramming and whiteboarding application that integrates with cloud storage providers like Google Drive, OneDrive, GitHub, GitLab, and Dropbox via OAuth. In self-hosted Docker and WAR deployments before version 30.2.7, the OAuth callback handler fails to validate the state token, allowing an attacker to trick a victim into signing in with the attacker's cloud account. The victim's session becomes authenticated as the attacker, enabling unauthorized actions on cloud storage under false attribution.
Technical details
The vulnerability exists in the OAuth callback handler (AbsAuth.java) which skips state token validation when IS_GAE is false, a condition met in self-hosted Docker and WAR deployments. An attacker can redirect a victim to a callback URL with an authorization code from the attacker's cloud identity, and without state validation, the victim's session becomes bound to the attacker's cloud account. The attack requires user interaction (victim visiting a malicious link) but no authentication prerequisites.
Affected products
- JGraph draw.io before 30.2.7
Timeline
- 2026-09-21: disclosed
- 2026-06-30: patched