CVE-2026-107433

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...

EUVD-2026-101008

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...

CVE-2026-107433

The WP OAuth Server plugin by miniOrange (versions up to and including 6.4.0 ) is vulnerable to a Broken Access Control issue (CWE-862). The root cause is Missing Authorization , which allows for the exploitation of Incorrectly Configured Access Control Security Levels . This vulnerability has a ...

CVE-2026-107433 WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Viet Tin in WordPress Plugin WP OAuth Server versions = 6.4.0...

CVE-2026-108718

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718: Missing Authorization

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-97288

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

EUVD-2026-89929

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288

The WordPress OAuth Server plugin, version 4.5.1 and below , is vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability is attributed to the Contributor role. While the vulnerability is confirmed, specific technical root causes, exploitation details, or remediation steps are not provid...

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...

PT-2026-103261

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...