CVE-2026-53501

Flawed string replacement allows HMAC bypass and unauthorized image loading.

• CVSS 8.2
• 347
• Authentication, Authorization, and Session Management
• Remote

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation. This allows crafting URLs where the validated string differs from the actual requested resource, enabling loading images from unintended domains or paths. This issue is fixed in 7.8.0.

CVE

CVE-2026-53501

CWE

347

CVSS base score

8.2

Published

2026-07-31

OWASP

A10 Server-Side Request Forgery (SSRF)

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Authentication, Authorization, and Session Management

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Thumbor

Fixed by upgrading

Yes

Solution

Upgrade Thumbor to version 7.8.0 or later.

import hmac
import hashlib
import base64
from urllib.parse import unquote

class HmacValidator:
    def __init__(self, security_key):
        if isinstance(security_key, str):
            security_key = security_key.encode("utf-8")
        self.security_key = security_key

    def _sign(self, url_part):
        signed = hmac.new(
            self.security_key, url_part.encode("utf-8"), hashlib.sha1
        ).digest()
        return base64.urlsafe_b64encode(signed).rstrip(b"=")

    def validate(self, signature, url):
        """
        Validates the signature for a given URL.
        The URL is expected to have the signature as the first part of its path.
        e.g., /<signature>/path/to/image
        """
        url = unquote(url)
        # VULNERABLE: Using .replace() without a count removes all occurrences of the signature.
        url_to_validate = url.replace(f"/{signature}", "")

        expected_signature = self._sign(url_to_validate).decode("ascii")

        return hmac.compare_digest(signature, expected_signature)

import hmac
import hashlib
import base64
from urllib.parse import unquote

class HmacValidator:
    def __init__(self, security_key):
        if isinstance(security_key, str):
            security_key = security_key.encode("utf-8")
        self.security_key = security_key

    def _sign(self, url_part):
        signed = hmac.new(
            self.security_key, url_part.encode("utf-8"), hashlib.sha1
        ).digest()
        return base64.urlsafe_b64encode(signed).rstrip(b"=")

    def validate(self, signature, url):
        """
        Validates the signature for a given URL.
        The URL is expected to have the signature as the first part of its path.
        e.g., /<signature>/path/to/image
        """
        url = unquote(url)
        # FIX: Using .replace() with count=1 ensures only the first occurrence is removed.
        url_to_validate = url.replace(f"/{signature}", "", 1)

        expected_signature = self._sign(url_to_validate).decode("ascii")

        return hmac.compare_digest(signature, expected_signature)

/{VALID_SIGNATURE}/unsafe/{VALID_SIGNATURE}/http://allowed-domain.com/image.jpg

@misc{vaitp:cve202653501,
  title        = {{Flawed string replacement allows HMAC bypass and unauthorized image loading.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-53501},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-53501/}}
}