hydra

채팅 · 토론 · 뉴스레터 · 문서 · Ory Network 사용해 보기 · 채용 Ory Hydra는 낮은 지연 시간, 높은 처리량, 낮은 리소스 소비에 최적화된 강화된OpenID 인증 OAuth 2.0 서버이자 OpenID Connect 제공자입니다. 로그인 및 동의 앱을 통해 기존 ID 제공자에 연결되므로 사용자 인터페이스와 경험을 완전히 제어할 수 있습니다. Ory Hydra란 무엇인가? Ory Hydra를 선택하는 이유 OAuth2 및 OpenID Connect: 공개 표준 OpenID Connect 인증 배포 옵션 O...

CVE-2026-22005-OAuth-2.0-Device-Code-Phishing-Short-Interval-

CVE-2026-22005 – OAuth 2.0 디바이스 코드 피싱 짧은 폴링 간격 프로그램 코드 Python devicecodeserver.py - Authorization server with too-fast polling import time, secrets codes = @app.route'/device/code' def devicecode: code = secrets.tokenurlsafe16 codescode = 'usercode': secrets.tokenhex4, 'status': 'pending' return...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE 레이스 조건 계정 탈취 개요 OAuth2 권한 부여 서버의 레이스 조건으로 인해, 공격자는 짧은 시간 창 안에서 PKCE codeverifier를 추측하거나 무차별 대입하여 합법적인 클라이언트가 인증 코드를 교환하기 전에 피해자의 인증 코드를 재사용할 수 있습니다. 심각도: 높음 계정 탈취 시뮬레이션 Python HTTP 서버 !/usr/bin/env python3 """ vulnerableauthserver.py - Authorization server with race...

CVE-2026-94276

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM 탐지 도구 방어용 작성자: https://github.com/FurkanKAYAPINAR/ CVE-2026-94127 에 대한 방어용, 비익스플로잇 탐지기로, F5 BIG-IP APM 의 힙 기반 버퍼 오버플로CWE-122로 인증되지 않은 원격 공격자가 원격 코드 실행RCE을 달성 할 수 있게 하는 취약점입니다. CVSS 3.1: 9.8 / CVSS 4.0: 9.3 치명적 실제 공격에서 활발히 악용 중 — CISA KEV 카탈로그에 등재됨. F5 권고 K000162605 ...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K000162605)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5.0.41.14 / 17.5.1.9.0.160.12 / 21.1.0.2.0.30.22. It is, therefore, affected by a vulnerability as referenced in the K000162605 advisory. When a BIG-IP APM access policy and an OAuth profile are configured on a...

CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

EUVD-2026-86018

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

PT-2026-97823

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.32 through 0.1.38 Description A remote attacker can obtain sensitive information, including internal configuration and values, by triggering metadata processing. The issue resides in the authorization server...

CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

CVE-2026-51995

The software geelen mcp-remote (versions 0.1.32 through 0.1.38 ) contains a vulnerability that allows a remote attacker to obtain sensitive information . The flaw is located within the src/lib/authorization-server-metadata.ts and src/lib/utils.ts components. No specific details regarding the root...

CVE-2026-51995: Exposure of Sensitive Information to an Unauthorized Actor

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

Exploit for CVE-2026-94127

CVE-2026-94127 — F5 BIG-IP APM Detection Tool Defensive A...

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers

Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager APM that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5...

VulnCheck KEV: CVE-2026-94127

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

CVE-2026-94127: Heap-based Buffer Overflow

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

Cross-site Scripting (XSS)

Spring Authorization Server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-controlled values being rendered without HTML entity encoding in the default consent page, which allows an attacker to inject malicious content through a crafted OAuth2 authorization request an...

CVE-2026-90474

MCPHub before 1.0.32 is affected by an authentication bypass in its embedded OAuth 2.0 authorization server. The root cause is that client authentication is disabled by default and PKCE enforcement is optional , allowing an attacker who intercepts an authorization code to redeem it for an access ...

EUVD-2026-76850

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...