CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

GHSA-29GX-H2M3-XW44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

Impact Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended. Patches - @backstage/plugin-scaffolder-backend versio...

CVE-2026-106462

The Backstage open framework for building developer portals is vulnerable in versions prior to 1.54.6 . The scaffolder source-control actions may fail to consistently enforce intended credential boundaries, potentially allowing an authenticated user to trigger an action that falls back to broader...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

The vulnerability of the GitHub authentication provider for Kubernetes Rancher’s cluster management software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the GitHub authentication provider for Kubernetes Rancher software management systems is related to flaws in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-41053

CVE-2026-41053 affects Rancher’s GitHub authentication provider, specifically the team membership expansion, where an incorrect authentication caching flaw could grant principal access to any logged-in user. Affected versions are 2.13 prior to 2.13.6 and 2.14 prior to 2.14.2. Root cause: faulty c...

CVE-2026-41053: Incorrect Implementation of Authentication Algorithm

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...

GHSA-5WXR-W449-57CM Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

Impact This affects only workflows that pin an exact affected Composer semver version through setup-php, for example tools: composer:2.9.7. Workflows using the default Composer version, composer:v2, or no pinned Composer version are not affected through setup-php, because those Composer URLs have...

PT-2026-41129

Name of the Vulnerable Software and Affected Versions shivammathur/setup-php versions 2.25.0 through 2.37.0 Description Command injection is possible when the action resolves the PHP version from repository-controlled files and incorporates these values into generated shell or PowerShell setup...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the GitHub OAuth callback handler when the refreshInterval query parameter is embedded verbatim into an error message and rendered unescaped into HTML. An attacker can execute arbitrary JavaScript in the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the GitHub OAuth callback handler when the refreshInterval query parameter is embedded verbatim into an error message and rendered unescaped into HTML. An attacker can execute arbitrary JavaScript in the...

EUVD-2022-4543

Malicious code in bioql PyPI...

EUVD-2022-4779

Malicious code in bioql PyPI...

EUVD-2022-3138

Malicious code in bioql PyPI...

CVE-2019-10315

Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF...

CVE-2019-1003019

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2019-1003018

An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser e.g. malicious extension to retrieve the...

CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...