CVE-2025-12028

1 启动一个简单的HTTP服务器来托管概念验证页面 mkdir -p /tmp/attacker && cd /tmp/attacker php -S 127.0.0.1:8000 2 创建文件 /tmp/attacker/poc.html，内容如下 document.getElementById'x'.submit; 3 在已登录的浏览器会话中触发PoC 当已登录以下地址时： http://localhost/wordpress 打开： http://127.0.0.1:8000/poc.html 在同一浏览器会话中。 4 观察授权重定向 浏览器将：...

CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

CVE-2026-104850

The MCP TypeScript SDK (versions 1.12.0 through 1.30.1) and @modelcontextprotocol/client (versions 2.0.0 through 2.1.0) are vulnerable to a flaw where the SDK's OAuth client allows a connected MCP server to dictate which authorization server receives client credentials. Because credentials were n...

EUVD-2026-93491

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

GHSA-6QXP-VCCF-F47H MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...

oauth-client-exploit

此存储库没有 README。...

CVE-2026-72887

A flaw was found in Net::OAuth::Client. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauthcallbackconfirmed parameter in the request token response. This downgrade vulnerability removes the oauthverifier binding, making the application...

PT-2026-105847

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

CVE-2026-97274

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

CVE-2026-97274 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

EUVD-2026-89923

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

CVE-2026-97274

The WordPress OAuth Single Sign On – SSO (OAuth Client) plugin, versions

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by rpgsec in WordPress Plugin OAuth Single Sign On – SSO OAuth Client versions = 7.1.2...

PT-2026-103255

Name of the Vulnerable Software and Affected Versions OAuth Single Sign On – SSO OAuth Client versions prior to 7.1.3 Description An authentication bypass exists in the OAuth Single Sign On – SSO OAuth Client plugin that is reachable pre-login. This allows unauthenticated attackers to forge a...

EUVD-2026-88754

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

PT-2026-102519

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

PT-2026-96925

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description OAuthConfig writes a plaintext fallback file containing access token and refresh token within the user's .mcp-atlassian directory. This file is created using process-default permissions rather...

CVE-2026-49254

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...