CVE-2026-118573

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

PT-2026-130600

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration t...

CVE-2026-73308

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in...

PT-2026-67930

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is in WHITELIST URLS, meaning it requires no authentication. It decrypts the stored credential containing clientId, clientSecret, refresh token, sends a refresh request to the configured OAuth provider,...

GCP Generate Access Token

Generate a short-lived OAuth2 access token for a target service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Generate Access Token", "description": "Generate a...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

EUVD-2021-9707

Malicious code in bioql PyPI...

EUVD-2022-7201

Malicious code in bioql PyPI...

CVE-2024-39315

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at "/.pomerium" unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may ...

CVE-2024-39315: Insertion of Sensitive Information Into Sent Data

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...

CVE-2023-2788 Deactivated user can retain access using oauth2 api

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...

PT-2023-18354 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token...

PT-2023-18545 · Unknown +1 · Mysql Server +2

Name of the Vulnerable Software and Affected Versions: a12nserver versions prior to 0.23.0 Description: The issue affects users of a12nserver who use MySQL, making them potentially vulnerable to SQL injection bugs. This could allow an attacker to obtain OAuth2 Access Tokens for unrelated users. T...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

CVE-2022-31690: Undefined Security Weakness

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...