CVE-2026-67993

Executive Summary

CVE-2026-67993 is a login cross-site request forgery (CSRF) vulnerability in Basecamp's upright project, specifically located in the static credentials callback handler at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f. An attacker who can induce an authenticated or unauthenticated victim to visit a malicious web page can cause the victim's browser to issue an unintended request to the static credentials callback, potentially binding attacker-controlled credentials or altering authentication state. The vulnerability is currently unpatched, has no assigned CVSS score from NVD, has no public proof-of-concept, and is not listed in CISA KEV — exploitation is entirely inferred from the stated vulnerability class.

⸻

Technical Analysis

The NVD description states that upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f "contains a login cross-site request forgery issue in the static credentials callback."

Breaking this down by vulnerability class:

Cross-Site Request Forgery (CWE-352). CSRF is a class of attack in which a web application performs a state-changing action based solely on a request that the browser attaches ambient credentials to (cookies, HTTP Basic auth, client certificates, or other automatically-included credentials). The application fails to verify that the request originated from its own origin, typically because it does not require a per-session anti-CSRF token, does not validate the Origin/Referer header, and/or accepts the request via a method (GET or unsynchronized POST) that a cross-site page can trigger.

"Login" CSRF specifically. The description qualifies this as a login CSRF (sometimes called "login CSRF" or "session fixation via CSRF"). In login CSRF, the attacker does not hijack an existing session — instead they force the victim's browser to authenticate to the application as the attacker (or with attacker-supplied credentials). The victim then unknowingly operates inside the attacker's account/session. Consequences include:

• The victim's subsequent actions (or data they enter) occur within the attacker's account, exposing that data to the attacker.
• The victim may be unable to distinguish the attacker-controlled session from their own.
• Conversely, if the callback binds credentials to an existing victim session, it can act as a session/identity fixation primitive.

"Static credentials callback" as the attack surface. The phrase indicates the vulnerable component is a callback endpoint that handles static (pre-configured, non-interactive) credentials. Because the mechanism is "static credentials," it likely does not follow an interactive, token-bound OAuth/OIDC-style flow with a per-transaction state parameter; that absence is precisely what enables CSRF. The callback accepts a request that establishes or changes authentication state without a session-bound anti-CSRF token.

Insufficient technical detail available. The provided intelligence does not include the exact endpoint path, HTTP method, parameter names, or code-level control flow. Per the accuracy constraints of this report, no specific route, function name, parameter name, or token name is asserted here; the analysis remains at the vulnerability-class level as documented in the NVD description.

Why this is significant. A static credentials callback that lacks CSRF protection is a design-level weakness, not a simple input-validation miss. Any consumer that deploys upright and relies on this callback to establish user or client authentication inherits the weakness. Because it is login-related, the failure affects the trust boundary at the very start of a session.

⸻

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-67993. The attack chain below is inferred from the vulnerability class (CSRF in a login/static-credentials callback) and uses only the surface identified in the NVD description. No specific endpoint paths, parameter names, or function names are fabricated.

1) Reconnaissance / target identification. The attacker identifies an instance of the affected upright deployment running at or derived from commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f. Because the vulnerability is in the login path, the target is any deployment exposing the static credentials callback to the browser. Public exposure can be discovered through internet-wide scanning for the callback surface and the distinctive page/asset content associated with upright.

2) Triggering the flaw class. The attacker prepares a malicious web page (or any injectable content) that causes the victim's browser to issue a request to the static credentials callback on the target deployment. Because the callback lacks CSRF protection (no session-bound anti-CSRF token verification and/or no Origin/Referer enforcement), the browser attaches whatever ambient credentials it holds for the target and the request is accepted as legitimate. The victim only needs to load the attacker-controlled page while the relevant site context (cookies/session) is active; no interaction beyond page load is required in the typical CSRF model.

3) Execution method (vulnerability-class level). Cross-site request forgery exploitation is typically delivered via an auto-submitting HTML form or a cross-origin request primitive embedded in a page the victim visits. The exact delivery vector (form POST, GET navigation, fetch/XHR subject to CORS, etc.) depends on the callback's accepted method and is not specified in the available intelligence. The essential mechanism is: attacker-controlled page → victim browser → unintended request to the static credentials callback.

4) Post-exploitation impact. Successful login CSRF results in the victim's browser establishing a session that is controlled by or associated with the attacker's credentials. From there the attacker can:

• Observe or harvest any data the victim enters into the now-attacker-linked session.
• Use the confused session state to blur attribution and compromise downstream actions.
• Chain the forced login with other application behavior to escalate impact if the application ties authorization to the bound identity.

Again, no public exploit exists, and there is no evidence of in-the-wild exploitation. The chain above is a class-level inference, not a verified exploit.

⸻

Impact Assessment

Confirmed facts from source data:

• CVSS score: N/A (no score assigned by NVD).
• EPSS: Not yet scored by FIRST.org.
• CWE: not assigned in the supplied data; classified here as CWE-352 based on the stated description.
• CISA KEV: No.
• PoC/exploit: None; Nuclei template: No.

Inferred impact framing (not a CVSS prediction). NVD has not published a vector, so no official subscores exist. For planning purposes only, a login-CSRF flaw of this type typically maps to a network-reachable, low-complexity issue requiring user interaction, with confidentiality and integrity impact limited to the authenticated user's context. This report deliberately does not present a fabricated CVSS number.

Business impact. Any organization deploying upright with the static credentials callback exposed to end users is affected. Impact is greatest where:

• Users authenticate to sensitive application areas through this callback.
• User-entered data in the resulting session is confidential (customer records, internal tooling, administrative consoles).
• The application uses identity from this callback for downstream authorization decisions.

Blast radius. Bounded by how widely upright is deployed as an authentication component. Because it is a source-repository component at a specific commit, each downstream deployment that vendors or pins that commit is independently affected. There is no central patch to consume, which widens the practical blast radius across the install base until each deployer remediates.

⸻

Detection Guidance

Detection for CSRF is inherently challenging because the malicious request often looks like a legitimate request to the target. Detection therefore focuses on request-context anomalies (cross-origin referrers, unexpected sequences) and on the execution of the malicious page on the client side.

Sigma Rule

title: Potential Login CSRF Against upright Static Credentials Callback
id: 5f7c2a10-6799-4c93-9d21-cve202667993
status: experimental
description: Detects requests to a static credentials callback that are missing expected CSRF/session token parameters or carry a cross-site Referer, indicative of login CSRF (CVE-2026-67993).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67993
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_callback:
    cs-uri-query|contains:
      - 'credentials'
      - 'callback'
  filter_expected_token:
    cs-uri-query|contains:
      - 'csrf'
      - 'state'
      - 'token'
  selection_crosssite_referer:
    cs-referer|startswith:
      - 'http://'
      - 'https://'
    cs-referer|notcontains:
      - 'upright'
  condition: selection_callback and selection_crosssite_referer and not filter_expected_token
falsepositives:
  - Legitimate callbacks from partner or federated identity providers
level: medium
tags:
  - attack.t1190
  - cwe.352

YARA Rule

rule CVE_2026_67993_upright_login_csrf
{
    meta:
        description = "Detects HTML/form artifacts consistent with a login CSRF page targeting the upright static credentials callback (CVE-2026-67993)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67993"
        author = "SOC Detection Engineering"
        date = "2026-01-01"
        cve = "CVE-2026-67993"
    strings:
        $s1 = "upright" ascii nocase
        $s2 = "credentials" ascii nocase
        $s3 = "callback" ascii nocase
        $csrf = "csrf" ascii nocase
        $state = "state=" ascii nocase
        $form = "<form" ascii nocase
        $autosubmit = "submit()" ascii nocase
        $onload = "onload=" ascii nocase
    condition:
        (uint16(0) == 0x3C21 or $form) and
        $s2 and $s3 and
        ($autosubmit or $onload) and
        not $csrf and not $state
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67993 Possible Login CSRF Request to upright Static Credentials Callback"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"callback"; nocase; http.uri; content:"credentials"; nocase; http.referer; content:"http"; http.referer; pcre:"/Referer:\s+https?:\/\/(?!(?:[^\/]*\.)?upright\.)/Hi"; classtype:attempted-user; reference:cve,2026-67993; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-67993; sid:2026679931; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.protocol == "http" and url.query contains "credentials" and url.query contains "callback"]
  [network where network.protocol == "http" and http.response.status_code >= 200 and
     not url.query contains "csrf" and not url.query contains "state" and
     not http.request.referrer contains "upright"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uriquery=urldecode(uri_query)
| where match(uriquery, "(?i)(credentials|callback)")
| where NOT match(uriquery, "(?i)(csrf|state|token)")
| where isnotnull(referer) AND NOT match(referer, "(?i)upright")
| eval src=clientip
| stats count values(uri_path) as paths values(referer) as refs by src
| where count > 2
| sort - count

Wazuh OSSEC Rule

<group name="web,cve_2026_67993,">
  <rule id="100993" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">(?i)(credentials|callback)</field>
    <field name="referer">^https?://</field>
    <description>CVE-2026-67993: potential login CSRF request to upright static credentials callback (cross-site referer)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_352,login_csrf,</group>
  </rule>

  <rule id="100994" level="12">
    <if_sid>100993</if_sid>
    <field name="url">(?!.*(?i)(csrf|state|token))</field>
    <description>CVE-2026-67993: CSRF callback request missing anti-CSRF token parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

⸻

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source.

The affected artifact remains at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f; no vendor fix, advisory, or upstream patch has been identified.

1) Immediate mitigations (deployer-side):

• Require a session-bound anti-CSRF token on the static credentials callback, or enforce strict Origin/Referer validation, at the reverse-proxy or application layer, until an upstream fix exists.
• Restrict the callback to expected origins and sources via a WAF or reverse-proxy allowlist (validate Origin/Referer against the deployment's own host).
• Where the static credentials callback is not required, disable that callback entirely.
• Consider short session lifetimes and re-authentication prompts on the login flow to limit the value of a forced login.

2) Patch / upgrade steps:

• No patch is available at this time. Do not assume a fixed version exists.
• Monitor the basecamp/upright repository for any commit beyond efe4f2e5254ac6e57e45d2261804cca74dbbca3f that introduces CSRF protection on the static credentials callback, and pin to it once validated.
• If you vendor or fork upright, apply a token-based CSRF control yourself and track the divergence, since no upstream fix is guaranteed.

3) Long-term hardening:

• Enforce per-transaction anti-CSRF tokens (state-style binding) on every authentication callback, including static-credential flows.
• Adopt SameSite=Lax or SameSite=Strict cookies for session material to blunt cross-site request delivery.
• Validate Origin/Referer on all state-changing endpoints, including login and credential-binding paths.
• Treat unmaintained or commit-pinned authentication components as supply-chain risk; require an SBOM and periodic dependency review so commit-pinned components like this remain visible to vulnerability management.

⸻

References

• NVD — CVE-2026-67993: https://nvd.nist.gov/vuln/detail/CVE-2026-67993
• CWE-352 — Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (no score currently published for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation status: No public exploit, no Nuclei template, no exploit code, and no CISA KEV listing were identified. No threat actor campaign or in-the-wild exploitation evidence is associated with CVE-2026-67993 in the available intelligence.