RabbitMQ Management - OAuth 2 Client Secret Disclosure

RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauthclientsecret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

CVE-2026-61397

Apache CloudStack is affected by an OAuth2 Token Cross-Request Leak in its OAuth2 authentication plugin and Google OAuth integration, classified as Exposure of Sensitive Information to an Unauthorized Actor . The vulnerability allows sensitive OAuth2 tokens to leak across requests, potentially ex...

EUVD-2026-63840

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...

CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

EUVD-2026-63540

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

CVE-2026-66001

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...

CVE-2026-77069

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

EUVD-2026-63258

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

CVE-2026-77069 n8n before 1.123.69 SSRF Protection Bypass via OAuth2

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

CVE-2026-77069

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

CVE-2026-77069 n8n before 1.123.69 SSRF Protection Bypass via OAuth2

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

CVE-2026-75628

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

CVE-2026-75628 Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

EUVD-2026-63189

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

CVE-2026-75628

Punk::OAuth2 versions before 0.03 for Perl have a same_origin_path validation flaw: backslash and tab characters in the return parameter pass the check, enabling open redirect to attacker-controlled sites after login. Per the URL Standard, backslash is treated as a slash for special schemes and t...

CVE-2026-55089 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

EUVD-2026-62737

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

CVE-2026-55089 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...