48968 matches found
Improper Authentication
Overview pytonapi is a Python SDK for TONAPI — REST API, streaming, and webhooks for TON blockchain. Affected versions of this package are vulnerable to Improper Authentication in the TonapiWebhookDispatcher process when a webhook handler is registered with a custom path argument. An attacker can...
SUSE CVE-2026-64834
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
GHSA-3735-5339-XFWX Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
Summary When an application uses OAuth2::Client typically via an OAuth2::AccessToken and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Clientrequest resolves the redirect with...
GHSA-PP92-CRG2-GFV9 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
Summary When an application uses OAuth2::Client typically via an OAuth2::AccessToken and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Clientrequest resolves the redirect with...
CVE-2026-54603 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
CVE-2026-54605
Summary: CVE-2026-54605 affects the Ruby OAuth gem (versions 0.5.5–1.1.5). The flaw in OAuth::Consumer#token_request follows 300–399 redirects by parsing the raw Location header and recursing, which can mutate the gem’s site/configuration and disclose signed OAuth request metadata (including the ...
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
CVE-2026-54605 OAuth: Cross-origin token-request redirects can expose signed request metadata
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
UBUNTU-CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...