PT-2026-135494

Control Web Panel CWP before webpanel version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access token, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization...

CVE-2026-74760

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760 Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

PT-2026-134919

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS cd vps/pocCVE0264 docker compose up -d...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-84178

CVE-2026-84178 — camel-oauth: authorization-code callback login CSRF missing state Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the OAuth authorization-code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI before 4.1.3 A simple POC CVE-2018-25031 that tricks the victim into entering the authorization code, which is then sent to the attacker. You can use it with the XSS Vulnerability https://github.com/VictorNS69/swagger-ui-xss It is necessary to find the parameter and...

CVE-2026-118959

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of...

CVE-2026-118959 Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of...

EUVD-2026-113443

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of...

CVE-2026-118959

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of...

CVE-2026-118959: Red Hat: A flaw was found in the required action provider mechanism of Keycloak

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kcaction query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of...

Python Social Auth: OpenID Connect Nonce Is Not Bound To The Browser Session, So A Stolen Authorization Code Logs The At

Summary The generic OpenID Connect backend "OpenIdConnectAuth" and every backend built on it stores the "nonce" in the shared Association table, not in the user's session. When the ID token comes back, "validateclaims" only checks that the nonce exists in that table and is not expired. It does no...

GHSA-H2R5-X5M7-3935 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

Summary The generic OpenID Connect backend OpenIdConnectAuth and every backend built on it stores the nonce in the shared Association table, not in the user's session. When the ID token comes back, validateclaims only checks that the nonce exists in that table and is not expired. It does not chec...

CVE-2026-115910

A flaw was found in social-auth-core. The OpenID Connect authentication backend stores nonces single-use security tokens used to prevent replay attacks in a shared table without binding them to the initiating browser session and authentication state. A remote attacker who obtains a victim's unuse...

CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...