GHSA-R4XP-PRCW-77QF better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

EUVD-2026-108972

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-93631

A cross-site request forgery (CSRF) vulnerability exists in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition versions 10.1.16 and 10.1.20 . The flaw stems from the OAuth callback failing to bind its state value or authorization code to the initiating Zimbra session, instead...

CVE-2026-104627

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity t...

CVE-2026-104627 Gitea OpenID account linking without session binding

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity t...

CVE-2026-104627

The Gitea OpenID association callback in the security settings is vulnerable to account hijacking because it accepts positive OpenID 2.0 assertions without verifying that the signed-in user initiated the linking process. Due to the nature of unsolicited assertions, an attacker controlling an Open...

CVE-2026-104627 Gitea OpenID account linking without session binding

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity t...

Linux Distros Unpatched Vulnerability : CVE-2026-62322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

DEBIAN-CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

EUVD-2026-102323

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

The Python Social Auth library is vulnerable to a Login CSRF attack in the LINE backend (LineOAuth2) prior to version 5.0.2 . The root cause is a failure to validate the returned OAuth state during the authorization code exchange. An attacker can initiate authorization for a controlled LINE accou...

CVE-2026-62322: Cross-Site Request Forgery (CSRF)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

PT-2026-115208

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.2 Description The LINE backend fails to validate the returned OAuth state during the exchange of an authorization code. This allows an attacker to initiate an authorization flow for an account they...

CVE-2026-100169

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...

CVE-2026-100169 Account pre-hijacking in the Prowler API through email based social account linking without verification

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...

CVE-2026-100169

The Prowler API (versions 5.4.0 to before 5.35.0) contains an improper authentication vulnerability in its social account linking path. The root cause is that ProwlerSocialAccountAdapter.pre_social_login() links Google or GitHub logins to any existing local account with a matching email address w...