CVE-2026-63373 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-63373

draw.io prior to version 30.2.7 contains an OAuth CSRF vulnerability in its callback handler (AbsAuth.java) that skips the stateToken/cookieToken comparison when IS_GAE is false, affecting self-hosted Docker and WAR deployments . An attacker can inject their own authorization code into a victim's...

CVE-2026-61687

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, contains an unauthenticated OAuth state CSRF / login-CSRF vulnerability in its ValidateOAuthState function (prior to 0.91.1 ). After a successful OAuth callback, the function clears the oauth_state_ session...

CVE-2026-73419

NextAuth.js/NMD vulnerability CVE-2026-73419 affects Auth.js OAuth/OIDC flow cookies. Prior to Auth.js @auth/core 0.41.3 and NextAuth.js 4.24.15 or 5.0.0-beta.32, state, nonce, and PKCE verifier were stored in global cookies not bound to the originating provider. On callback, a value from one pro...

CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

HackerOne: Changing Victim's JIRA Integration Settings Through Multiple Bugs

Summary: Changing victim's JIRA integration settings through multiple bugs. Description: Using multiple HackerOne bugs, an attacker can change the victim's JIRA integration settings. Bugs: 1 The Jira integration consent screen lacks information about the Jira project that will be connected to...