CVE-2026-108157: Improper Authentication

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...

CVE-2026-56734: Server-Side Request Forgery (SSRF)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-73419: Insufficient Verification of Data Authenticity

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

CVE-2026-12379: URL Redirection to Untrusted Site

An Open Redirect vulnerability CWE-601 exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted...

CVE-2026-12593: Missing Authorization

The implementation of an internal and undocumented Dashboard API endpoint POST /api/users//user/tokens forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user with more...

CVE-2024-13301: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client allows Cross-Site Scripting XSS.This issue affects OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client: from 3.0.0...