CVE-2026-118573

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

CVE-2026-118573

The Drupal OAuth2 Token Manager module (versions 0.0.0 to 1.2.0 ) is vulnerable to a Missing Authorization (CWE-862) issue. The module fails to restrict access to its OAuth2 routes , which could allow an anonymous visitor to connect the site's integration to an account they control. However, the ...

CVE-2026-118573 OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

EUVD-2026-113684

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

CVE-2026-118573: Drupal OAuth2 Token Manager: Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration t...

WSO2 API Manager session mechanism vulnerability

Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...

Use of Cache Containing Sensitive Information

Overview org.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the OAuth2 token cache in the camel-http component. The...

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

DEBIAN-CVE-2026-92288

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

EUVD-2026-86487

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

CVE-2026-92288: Weak Authentication

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...

Linux Distros Unpatched Vulnerability : CVE-2026-92288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because...

SUSE CVE-2026-56668

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

GHSA-VRH8-C9CM-WH8V ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

CVE-2026-54072

Authorizer , an open-source self-hostable authentication and authorization server, is affected by an unvalidated redirect_uri in its /authorize endpoint prior to version 2.2.1 . When response_type=token or response_type=id_token, the server appends access_token , id_token , and refresh_token as q...