SourceHut meta.sr.ht vulnerabilities

Latest SourceHut meta.sr.ht CVEs

Newest publication first

1. CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2

   Published 2026-11-03

   Medium·CVSS 6.9 EPSS 0.26%

   SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.