← Vulnerability feed

Vulnerability record · CVE-2026-68945 · published 3 August 2026

CVE-2026-68945: Angular insufficient verification of data authenticity vulnerability

Angular · Angular

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

8.8 CVSS 4.0 High EPSS 0.18% · top 93.5% CWE-345 · Insufficient verification of data authenticity
8.8CVSS 4.0 base score
0.18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
11 Aug 2026Last modified by NVD

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/angular/angular/commit/6867f77ec779a0a24f6339ad6c775f444202103c Patch
https://github.com/angular/angular/commit/948a8d6831e8920b54663ec79421da95210e0e35 Patch
https://github.com/angular/angular/commit/a64e2883e9dc4abdac70209129be303de79e5b2b Patch
https://github.com/angular/angular/commit/a6c7fc5c13e6e494a4c9bd8e773b8d4b2a99b20c Patch
https://github.com/angular/angular/pull/68571 Issue Tracking
https://github.com/angular/angular/security/advisories/GHSA-jhpw-976m-542j Vendor Advisory

Track CVE-2026-68945 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-50168Angular origin validation error vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.24%8.8CVE-2026-46417Angular server-side request forgery (ssrf) vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-n…EPSS 0.36%8.8CVE-2026-54266Angular insufficient verification of data authenticity vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, …EPSS 0.13%8.7CVE-2026-41423Angular server-side request forgery (ssrf) vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions…EPSS 0.48%8.6CVE-2026-69149Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27,…EPSS 0.35%8.6CVE-2026-50555Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.27%8.6CVE-2026-50556Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-r…EPSS 0.41%8.6CVE-2026-54267Angular cross-site scripting vulnerabilityAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, …EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2026-68945), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.