ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-59316 Source advisory:...

CVE-2026-48153

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no...

CVE-2026-48153: Server-Side Request Forgery (SSRF)

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.12.1, <=2.7.16.final), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.12.1, <=2.7.16.final) +4 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.20, <=2.7.0.50), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.20, <=2.7.0.50) +3 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.3.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.beta4, <=2.7.0.10), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.beta4, <=2.7.0.10) +2 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization-server (2.7.0.beta3), cn.herodotus.engine:oauth2-sdk-data-jpa (2.7.0.beta3) potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.2)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.7.3, <=2.7.8.0), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.7.4, <=2.7.8.0) +11 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...