keycloak-services: keycloak-services: Admin API missing audience check

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token...

keycloak-services: keycloak-services: Token refresh continues issuing tokens for disabled audience clients

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-111771

A flaw was found in the Model Context Protocol MCP TypeScript SDK. The server-side authentication mechanism fails to verify that incoming access tokens were specifically issued for the target server. A remote attacker with a valid token issued for another service within the same authorization...

CVE-2026-118167

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...

CVE-2026-19688 Keycloak-services: keycloak-services: admin api missing audience check

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token...

CVE-2026-19688

A flaw exists in the Admin REST API of Keycloak , an identity and access management solution, where the API fails to verify the intended audience of bearer tokens during authentication. An attacker operating a client within a realm can capture an administrator's access token and reuse it to perfo...

CVE-2026-118167 MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any...

WordPress MC4WP: Mailchimp for WordPress plugin < 4.15.0 - Unauthenticated Subscription Audience Override vulnerability

Unauthenticated Subscription Audience Override vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MC4WP versions 4.15.0...

CVE-2026-118167

The MC4WP: Mailchimp for WordPress plugin (versions before 4.15.0 ) is vulnerable to an unauthenticated subscription audience override due to insufficient validation. The plugin fails to verify that the Mailchimp audience associated with a sign-up form or bundled integration matches the specific ...

CVE-2026-111771

The Model Context Protocol TypeScript SDK is vulnerable to a security flaw in its server-side HTTP bearer authentication because it fails to enforce the token audience (aud) . Specifically, the SDK could accept a valid access token issued for a different service if the authorization server issues...

CVE-2026-111771 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and...

CVE-2026-62662

Pocket ID versions 1.11.0 through 2.10.0 are vulnerable to an improper authorization flaw in the createTokenFromClientCredentials function within backend/internal/service/oidc_service.go. The root cause is that the system accepts a client-controlled resource parameter and embeds it into the acces...

CVE-2026-62662 Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...

PT-2026-137234

Name of the Vulnerable Software and Affected Versions Pocket ID versions 1.11.0 through 2.9.9 Description An issue exists in the OIDC provider where the createTokenFromClientCredentials function in backend/internal/service/oidc service.go accepts a client-controlled resource parameter and embeds ...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...

SUSE CVE-2026-33557

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...

SUSE CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...

Model Context Protocol Python SDK: Server Bearer-token Authentication Accepts Tokens Issued For A Different Resource Ser

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

CVE-2026-118687

The Coder platform (versions before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4) fails to validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. This vulnerability al...