26 matches found
CVE-2026-82753
ash_authentication_oauth2_server (ash-project) suffers from an Allocation of Resources Without Limits or Throttling vulnerability in the /authorize endpoint when Client ID Metadata Documents (CIMD) are enabled. The resolve_client/3 function fetches a metadata document for each new URL-shaped clie...
GHSA-RXPG-WJF8-QV9C Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Attack type: Unauthenticated remote Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability...
CVE-2026-55549 Yamcs: Reflected XSS in the URL of the Authorize Endpoint
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...
EUVD-2026-67841
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.ja...
CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...
CVE-2026-70556 Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration
Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...
CVE-2026-70556
Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...
CVE-2026-70556 Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration
Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...
CVE-2026-70556
Hubzilla 11.2.1 contains a CSRF vulnerability in the OAuth2 /authorize endpoint (Zotlabs\Module\Authorize::post()) that lets unauthenticated attackers silently register arbitrary OAuth2 applications under a victim’s authenticated account by submitting a cross-origin POST without CSRF token or Ori...
GO-2026-5959 Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL in github.com/authorizerdev/authorizer
Authorizer: Unvalidated redirecturi in /authorize leaks OAuth2 tokens to attacker-controlled URL in github.com/authorizerdev/authorizer...
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...
PT-2026-57366
Name of the Vulnerable Software and Affected Versions Authorizer versions prior to 2.0.1 Description The /authorize endpoint fails to validate the redirect uri parameter against a list of allowed origins. When the response type is set to token or id token, the server appends the access token, id...
CVE-2026-30346
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL...
CVE-2026-30346
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL...
PT-2026-35453
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL...
CVE-2026-30346
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL...
CVE-2026-30346
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL...
CVE-2026-30346
CVE-2026-30346 affects hunvreus DevPush v0.3.2 with an open redirect in the /api/google/authorize endpoint. The underlying issue allows an attacker to redirect users to malicious sites by supplying a crafted URL. Impact details are that redirects could lead users to unintended destinations; explo...