CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

CVE-2023-0264

Preuve de concept pour CVE-2023-0264 Vulnérabilité Keycloak permettant le détournement de session pendant le flux de code d'autorisation Voir https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prérequis Docker curl jq python3 ou un autre outil pour servir des fichiers statiques sur HTTP Étapes pou...

POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI vor 4.1.3 Ein einfacher POC CVE-2018-25031, der das Opfer dazu bringt, den Autorisierungscode einzugeben, der dann an den Angreifer gesendet wird. Sie können es mit der XSS-Schwachstelle https://github.com/VictorNS69/swagger-ui-xss verwenden. Es ist notwendig, den...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — Frontend OIDC-Session-Hijacking Statisches Frontend, das den OIDC-Ablauf Authorization Code gegen eine Keycloak-Instanz ausführt und den sessionid-Entführungshook des PoC bereitstellt. Es wird mit nginx auf Port 5174 für das Team bereitgestellt. Starten auf der VPS...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Ein nicht-intrusiver, versionsbasierter Schwachstellen-Scanner für CVE-2026-4282 , der Keycloak und Red Hat Build of Keycloak RHBK betrifft. ⚠️ Haftungsausschluss: Dieses Tool ist ausschließlich für autorisierte Sicherheitsforschung, Penetrationstests und defensive...

CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

CVE-2026-68079

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

CVE-2026-57818

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized...

CVE-2026-68079

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-57818

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-57818

The vulnerability CVE-2026-57818 affects the JCacheCodeDataProvider used in Apache CXF’s OAuth2 implementation. A TOCTOU race condition allows an attacker to redeem a single authorization code multiple times through concurrent requests, causing issuance of multiple distinct, valid access tokens. ...

CVE-2026-68079

Apache CXF’s DefaultEncryptingCodeDataProvider has a flaw in removeCodeGrant that allows an authorization code to be redeemed unlimited times, violating the one-time-use RFC requirement. This can enable unlimited replay of captured codes. Affected versions are fixed in CXF 4.2.3, 4.1.8, and 3.6.1...

EUVD-2026-53858

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...