202 matches found
CVE-2026-116072
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the...
CVE-2026-116072 Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the...
CVE-2026-116072 Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the...
CVE-2026-116072
The Infinity for Reddit application (through version 8.3.4 ) is vulnerable to a login cross-site request forgery (CSRF) vulnerability within the LoginChromeCustomTabActivity redirect handler. The root cause is the handler's use of a hardcoded OAuth state value . An attacker can authorize the app'...
PT-2026-122975
Name of the Vulnerable Software and Affected Versions Infinity for Reddit versions prior to 8.3.5 Description A login cross-site request forgery issue exists in the exported LoginChromeCustomTabActivity redirect handler. The handler uses a hardcoded OAuth state value, which allows an attacker to...
CVE-2026-86467
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-86467
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-86467
The apache-airflow-providers-amazon package (versions >=9.0.0,
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
EUVD-2026-104790
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
PT-2026-118101
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...
CVE-2026-110008
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
EUVD-2026-104327
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008
The @fastify/oauth2 library (versions 7.2.0 through 8.3.1 ) is vulnerable to Login CSRF because state and code-verifier cookies are set without a Path attribute on routes with multiple segments. During the OAuth callback, the clearing step uses a root path, causing the original cookies to persist...
CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
