EUVD-2026-75540

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89454

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

cs50-cyber-paloalto-oauth

Proyecto Final de Ciberseguridad CS50 Título: La Brecha OAuth de Salesloft y CVE-2024-3400 impacto en Palo Alto Autor: Yafiya Darwesh GitHub: Yafiah-Darwesh Video de YouTube: https://youtu.be/CxQNj9qWoZ0?si=cHCwuTIY26YHJ8aw CVE: CVE-2024-3400 Archivos presentation.pdf — diapositivas script.txt —...

EUVD-2026-72933

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

CVE-2026-86725

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

EUVD-2026-72861

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

CVE-2026-80219

A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure vulnerability

Unauthenticated OAuth Token and User Data Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WP OAuth Server versions 6.3.1...

EUVD-2026-63467

WebOb: Open redirect in Location header normalization via leading C0 control / space characters...

CVE-2026-19715

The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.3.1 , fails to restrict access to its debug log file , which is written to a fixed and publicly reachable location. When debug logging is enabled, unauthenticated attackers can read OAuth tokens , authorization code...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...