CVE-2026-58016

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

CVE-2026-58016

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

CVE-2026-58016

The CVE-2026-58016 entry concerns GLib, specifically a flaw in g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c. The issue arises when parsing malformed D-Bus introspection XML (notably a element nested inside ///), causing an unsigned integer overflow and an out-of-bounds read, which ...

EUVD-2026-40319

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a element nested within other elements like , , or . This issue can cause an unsigned integer overflow and...

CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

PT-2026-53875

Name of the Vulnerable Software and Affected Versions GLib affected versions not specified Description A state confusion issue exists in the g dbus node info new for xml function within the gio/gdbusintrospection.c file. This occurs when the software processes malformed D-Bus introspection XML,...

GO-2026-5291 nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node

nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node...

org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: Security flaw in org.keycloak/keycloak-services

A flaw was found in Keycloak. When both realm-level and client-level notBefore revocation policies are configured, Keycloak's OpenID Connect OIDC Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially...

GHSA-4MVW-J8R9-XCGC OpenCTI May Bypass Introspection Restriction

Summary The regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Details GraphQL Queries in OpenCTI can be validated using the secureIntrospectionPlugin. Impact Bypassing this restriction...

EUVD-2024-36468

OpenCTI May Bypass Introspection Restriction...

Authentication Bypass

github.com/googleapis/mcp-toolbox is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the optional issuer iss claim during OAuth 2.0 opaque token introspection. If the introspection response omits the iss field, the issuer validation is silently skipped, whi...

Authentication Bypass

github.com/googleapis/mcp-toolbox is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of OAuth 2.0 token introspection responses, where the mandatory active field is not verified if omitted, which allows an attacker to bypass authentication by supplying an opaq...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the validateOpaqueToken process. An attacker can gain unauthorized access to protected tools and underlying data sources by submitting an OAuth 2.0 introspection response that omits the mandatory active...

GHSA-8FCC-W5HV-4GXV googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint RFC 7662, the toolbox decodes the response into an introspectResp struct where t...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the validateOpaqueToken process. An attacker can gain unauthorized access to protected tools and underlying data sources by submitting an OAuth 2.0 introspection response that omits the mandatory active...

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint RFC 7662, it decodes the response into an introspectResp struct. However, the...

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint RFC 7662, the toolbox decodes the response into an introspectResp struct where t...

CVE-2026-11718

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint RFC 7662, it decodes the response into an introspectResp struct. However, the...

CVE-2026-11717

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint RFC 7662, the toolbox decodes the response into an introspectResp struct where t...

CVE-2026-11718

An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint RFC 7662, it decodes the response into an introspectResp struct. However, the...