CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-59357

Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...

CVE-2022-25262

CVE-2022-25262 PoC + detalles de la vulnerabilidad CVE-2022-25262 | JetBrains Hub: toma de control de la respuesta SAML con un solo clic CVE-2022-25262 Requisitos Uso ¿Cómo funciona? Pool de códigos de autorización para el intercambio «OAuth2 - SAML» Apropiación del código de autorización OAuth2 ...

CVE-2023-0264

PoC para CVE-2023-0264 Vulnerabilidad de Keycloak que permite el secuestro de sesión durante el flujo de código de autorización Ver https://github.com/advisories/GHSA-9g98-5mj6-f9mv Requisitos previos Docker curl jq python3 u otra herramienta para servir archivos estáticos en HTTP Pasos para...

POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI antes de 4.1.3 Un simple POC CVE-2018-25031 que engaña a la víctima para que ingrese el código de autorización, el cual luego se envía al atacante. Puedes usarlo con la vulnerabilidad XSS https://github.com/VictorNS69/swagger-ui-xss Es necesario encontrar el parámetro ...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front OIDC session hijacking Front estático que ejecuta el flujo OIDC authorization code contra un Keycloak y expone el hook de secuestro de sessionid del PoC. Se sirve con nginx en el puerto 5174 para uso del equipo. Levantarlo en la VPS cd vps/pocCVE0264 docker compose up -d...

PT-2026-102981

Name of the Vulnerable Software and Affected Versions oauthlib affected versions not specified Description A timing side-channel exists in the PKCE implementation of the Authorization Code Grant flow. The functions code challenge method plain and code challenge method s256 in the file...

EUVD-2026-88033

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-92289

A flaw was found in lemonldap-ng. When configured to accept either client secrets or Proof Key for Code Exchange PKCE, a security mechanism designed to protect authorization codes, the portal fails to validate client credentials properly for public clients. A remote attacker who intercepts an...

CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl are vulnerable to a PKCE bypass in "PKCE or secret" mode. The root cause is that the checkEndPointAuthenticationCredentials function fails to verify the client secret for public Relying Parties. When oidcRPMetaDataOptionsRequirePKC...

CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

PT-2026-98320

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 Description An issue exists where public Relying Parties in PKCE or secret mode can bypass Proof Key for Code Exchange PKCE, a security extension for OAuth 2.0 that prevents authorization co...

CVE-2026-92289: Weak Authentication

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

org.apache.cxf/cxf: Apache CXF: Authorization Code Replay via Race Condition

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized...

org.apache.cxf/cxf: Apache CXF: Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

Linux Distros Unpatched Vulnerability : CVE-2026-92289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in PKCE or secret mode because...

CVE-2026-96446

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...