CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE レースコンディション（アカウント乗っ取り） 概要 OAuth2 認可サーバーのレースコンディションにより、攻撃者は短い時間ウィンドウ内で PKCE の codeverifier を推測またはブルートフォースし、正規クライアントが認可コードを利用する前に被害者の認可コードを再利用できる可能性があります。 深刻度: 高（アカウント乗っ取り） シミュレーション（Python HTTP サーバー） root@kitploit: !/usr/bin/env python3 """ vulnerableauthserver.py -...

SUSE CVE-2026-26247

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

CVE-2026-8590 Spotfire OAuth2 PKCE Bypass for public clients

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

GHSA-M5CH-PPFX-XV3V Gitea OAuth2 PKCE S256 verifier bypass

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

Gitea OAuth2 PKCE S256 verifier bypass

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

CVE-2026-26247

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

CVE-2026-26247: Improper Access Control

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

EUVD-2023-3295

Malicious code in bioql PyPI...

CVE-2023-50714

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

CVE-2023-50714: Server-Side Request Forgery (SSRF)

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...