cs-token-vault

Token Vault BOF per Cobalt Strike Questo Beacon Object File BOF crea una memoria in-memory per i token di accesso Windows rubati/duplicati, consentendoti di: Hot swap/riutilizzare token già rubati senza duplicarli di nuovo. Memorizzare i token per un uso futuro nel caso un utente si disconnetta...

EUVD-2026-65450

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero,...

CVE-2026-49050

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

EUVD-2026-65391

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49050

Apache DolphinScheduler versions prior to 3.4.2 are affected by a privilege escalation vulnerability where a general user can mint admin access tokens by interacting with the /access-tokens endpoint. This grants a low-privileged user full administrative control, resulting in high impact on confid...

TokenPlayer

TokenPlayer Manipolazione e abuso dei token di accesso di Windows. TokenPlayer è solo un piccolo strumento che ho realizzato per imparare la programmazione dell'API win32 e comprendere meglio il modello dei token di accesso di Windows. Caratteristiche: Rubare e impersonare i token primari...

CVE-2026-50191 4gaBoards: Pre-Account Takeover via SSO Email Linkage

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

PT-2026-78234

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8 Description An issue exists when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The 'POST /api/register' endpoin...

CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...

CVE-2026-48039

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

UBUNTU-CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-57818

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

EUVD-2026-53862

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818

The vulnerability CVE-2026-57818 affects the JCacheCodeDataProvider used in Apache CXF’s OAuth2 implementation. A TOCTOU race condition allows an attacker to redeem a single authorization code multiple times through concurrent requests, causing issuance of multiple distinct, valid access tokens. ...

CVE-2024-8995

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials clie...

EUVD-2025-210629

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...