SourceHut disabled registration bypass | CVE-2026-121728
SourceHut, a CI platform, recently discovered a security flaw that allowed account takeover through a Cross-Site Request Forgery (CSRF) attack. The issue stemmed from a logic bug introduced during the refactoring of the registration process in 2021. Despite the frontend indicating that registration is closed, the backend still had a registration form handler that didn't properly check for the registration status on the happy path.
An attacker could exploit this by POSTing to /register/step2 with their desired username, email, and password to gain unauthorized access. The CSRF token vulnerability stemmed from the fact that the form handler lacked the necessary scope-limitation, allowing the standard CSRF token from /login to work. This flaw affected SourceHut versions 0.56.11 through 0.88.9.
The researchers disclosed the vulnerability to SourceHut's security mailing list on November 2, 2026, and it was subsequently fixed. The researchers have requested a CVE ID from VulnCheck and encouraged a more responsive contact channel as well as the establishment of a bug bounty program with an upfront participation fee.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
