---
id: CVE-2026-63373
title: draw.io is a configurable diagramming and whiteboarding application
summary: >-
  draw.io is a configurable diagramming and whiteboarding application. Prior to
  version 30.2.7, the OAuth callback handler in
  src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken
  and cookieToken whenever IS_GAE is f…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-352
vendor: jgraph
product: drawio
affected:
  - drawio < 30.2.7
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:26:49.087'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63373'
references:
  - url: >-
      https://github.com/jgraph/drawio/commit/650fbd742814f6502f78248dc2d8e2aaa5e42b5e
    label: security-advisories@github.com
  - url: 'https://github.com/jgraph/drawio/releases/tag/v30.2.7'
    label: security-advisories@github.com
  - url: 'https://github.com/jgraph/drawio/security/advisories/GHSA-mcj5-3pww-7g49'
    label: security-advisories@github.com
  - url: 'https://github.com/jgraph/drawio/security/advisories/GHSA-mcj5-3pww-7g49'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00153
epssPercentile: 0.03681
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T18:01:15.917455Z'
ingestedAt: '2026-09-21T16:49:07.869Z'
---

## Overview

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.