POC-CVE-2018-25031

CVE-2018-25031 - Swagger UI antes de 4.1.3 Un simple POC CVE-2018-25031 que engaña a la víctima para que ingrese el código de autorización, el cual luego se envía al atacante. Puedes usarlo con la vulnerabilidad XSS https://github.com/VictorNS69/swagger-ui-xss Es necesario encontrar el parámetro ...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front（OIDCセッションハイジャック） Keycloakに対してOIDC（authorization code）フローを実行し、PoCのsessionidハイジャックフックを公開する静的フロントエンド。チーム利用のためnginxでポート5174 に配信される。 起動方法（VPS上で） root@kitploit: cd vps/pocCVE0264 docker compose up -d --build http://maquina:5174 で利用可能。プロバイダーのファイアウォールで5174/TCP を開放する（8443と同じように）。...

BIT-KEYCLOAK-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

CVE-2023-0264

PoC para CVE-2023-0264 Vulnerabilidad de Keycloak que permite el secuestro de sesión durante el flujo de código de autorización Ver https://github.com/advisories/GHSA-9g98-5mj6-f9mv Requisitos previos Docker curl jq python3 u otra herramienta para servir archivos estáticos en HTTP Pasos para...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Uno scanner di vulnerabilità non intrusivo, basato sulla versione, per CVE-2026-4282 , che interessa Keycloak e Red Hat Build of Keycloak RHBK. ⚠️ Disclaimer: Questo strumento è destinato esclusivamente a ricerche di sicurezza autorizzate, test di penetrazione e gestione...

CVE-2026-82274

Twenty through version 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint. The root cause is that the state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary ho...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server through 0.16.19 fails to validate OAuth redirect_uri against registered destinations in its default configuration. The root cause lies in crates/http/src/auth/oauth/registration.rs, where the validation routine returns success immediately because the client-authentication req...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

PT-2026-82224

Name of the Vulnerable Software and Affected Versions Stalwart Mail Server affected versions not specified Description In its default configuration, the server fails to validate OAuth redirect targets against registered destinations. The validation routine in...

CVE-2026-79786

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their...

CVE-2026-79786 Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their...

ANT-2026-CGR7Y3J8 · supabase/auth · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CGR7Y3J8: OAuth authorization code single-use not enforced atomically In the authorizationcode grant handler of the...

CVE-2026-73563

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

CVE-2026-68079

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

CVE-2026-57818

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized...

CVE-2026-68079

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...