Internet Bug Bounty: Race Conditions in OAuth 2 API implementations

Most of OAuth 2 API implementations seem to have multiple Race Condition vulnerabilities for processing requests for Access Token or Refresh Token. Race Condition allows a malicious application to obtain several accesstoken and refreshtoken pairs while only one pair should be generated. Further, ...

RubyGems Doorkeeper Cross-Site Request Forgery Vulnerability

RubyGems gems is a Ruby packaging system for packaging Ruby components. A cross-site request forgery vulnerability exists in RubyGems Doorkeeper because it fails to properly validate HTTP requests. An attacker could use this vulnerability to perform unauthorized actions in the context of a...

CVE-2014-8144

Cross-site request forgery CSRF vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors...

CVE-2014-8144

Cross-site request forgery CSRF vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors...

CVE-2014-8144

CVE-2014-8144 concerns the Doorkeeper gem (Rails) and is evidenced by multiple sources in connected documents. The vulnerability is a CSRF flaw in Doorkeeper before 1.4.1 that allows remote attackers to hijack a user’s OAuth authentication by reading a user’s authorization code via unknown vector...

Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and earlier.

Cross-site request forgery CSRF vulnerability in doorkeeper 1.4.0 and earlier allows remote attackers to hijack the user's OAuth autorization code. This vulnerability has been assigned the CVE identifier CVE-2014-8144. Doorkeeper's endpoints didn't have CSRF protection. Any HTML document on the...