EUVD-2026-97585

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283

Open WebUI versions 0.11.1 before 0.11.4 are vulnerable to an authorization bypass in the OAuth token exchange endpoint. The flaw occurs because the system only reads role claims from the provider's userinfo response and retains the user's existing role if no new claim is found, failing to accoun...

CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-102877

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877

The Fider application (versions prior to 0.38.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a time-of-check time-of-use (TOCTOU) gap during URL validation for webhooks and custom OAuth provider endpoints. An attacker who controls DNS can utilize a DNS rebinding attac...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

EUVD-2026-89412

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877: Server-Side Request Forgery (SSRF)

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

PT-2026-98894

Name of the Vulnerable Software and Affected Versions FriendsOfFlarum OAuth versions prior to 1.7.4 FriendsOfFlarum OAuth versions prior to 2.0.0-beta.4 Description An account takeover issue exists when the Discord OAuth provider is enabled. The provider fails to check the verified field of the...

CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

@anchrd/gate (>=0.28.0, <=0.40.0), @anchrd/gate-api (>=0.1.1, <=0.26.0) +29 more potentially affected by CVE-2026-67332 via @better-auth/oauth-provider (>=1.5.5, <=1.6.28)

@better-auth/oauth-provider NPM version =1.5.5, =0.28.0, =0.1.1, =1.0.0, =2.0.0, =2.0.0, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712,...

CVE-2026-67332

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...