121 matches found
WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure vulnerability
Unauthenticated OAuth Token and User Data Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WP OAuth Server versions 6.3.1...
CVE-2026-18918
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...
CVE-2026-19715
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
EUVD-2026-66876
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19715
The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.3.1 , fails to restrict access to its debug log file , which is written to a fixed and publicly reachable location. When debug logging is enabled, unauthenticated attackers can read OAuth tokens , authorization code...
CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
PT-2026-82392
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19078
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
CVE-2026-19078 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
CVE-2026-19078
CVE-2026-19078 affects the oauth-server component. The open redirect occurs when the then parameter in the grant-approval handler is not properly validated, allowing an authenticated user to be redirected to an attacker-controlled site. Impact could enable phishing to steal sensitive information....
CVE-2026-19078 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
EUVD-2026-56228
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
CVE-2026-19078
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
PT-2026-70242
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
CVE-2026-65520
CVE-2026-65520 concerns the WordPress plugin WP OAuth Server (vulnerable:
CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
EUVD-2026-53969
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-13707
CVE-2026-13707 : Session fixation vulnerability in Wikimedia Foundation OAuth. Affected: OAuth server components (MWOAuthServer.Php) in Wikimedia Foundation's OAuth deployment, with versions from 1.43.9 through 1.46.0 vulnerable to session fixation due to issues in the OAuth flow. CVSS 3.1 base s...