Design/Logic Flaw

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.34.0, the TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can...

CVE-2020-15222

ORY Fosite (Go) prior to v0.31.0 did not check jti uniqueness when using private_key_jwt client authentication, enabling possible replay of token requests. OpenID Connect requires a unique jti to prevent reuse; this vulnerability is addressed in v0.31.0. Other connected records (RH, OSV, GHSA, CV...

CVE-2020-15222 Replay of private_key_jwt possible in ORY Fosite

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.31.0, when using "privatekeyjwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "privatekeyjwt", OpenId specification says the following about asserti...

CVE-2020-15223 Ignored storage errors on token revokation in ORY Fosite

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.34.0, the TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can...

CVE-2020-15223

CVE-2020-15223 affects ORY Fosite (Go) prior to 0.34.0, where TokenRevocationHandler ignores errors from storage. This can cause a revoked token to still appear valid, potentially producing 200 responses even when revocation failed, depending on the ability to trigger storage errors. The issue is...

@rebelware/fibonacci-generator (0.0.3), react-oauth2-auth-code-flow (>=1.0.0, <=1.0.2) potentially affected by unknown CVE via react-oauth-flow (1.2.0)

react-oauth-flow NPM version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-oauth-flow and may be impacted: - @rebelware/fibonacci-generator 0.0.3 - react-oauth2-auth-code-flow =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory:...

CVE-2020-4037

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

CVE-2020-4037

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

Design/Logic Flaw

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

CVE-2020-4037

CVE-2020-4037 concerns OAuth2 Proxy where versions 5.1.1 and older (up to 5.9.x) allow a user-supplied redirect URL at the end of the authentication flow. The redirect target is validated by the proxy, but the issue arises from insufficiently restricted redirects, potentially enabling open redire...

CVE-2020-4037 Open Redirect in OAuth2 Proxy

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

PT-2020-17845 · Oauth2 Proxy · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: OAuth2 Proxy versions 5.1.1 through 5.9.x Description: The issue allows users to provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This redirect URL is checked within the proxy a...

CVE-2020-4037: URL Redirection to Untrusted Site

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

CVE-2017-18906

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2017-18906

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2017-18906

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2017-18906

Summary: Mattermost Server versions before 4.0.0, 3.10.2, and 3.9.2 are affected by a vulnerability in Single Sign-On OAuth2 that could allow an attacker to claim another user’s account. The connected Red Hat, OSV, CNVD, and NVD references corroborate the issue; however, the provided documents do...

CVE-2017-18906: Improper Authentication

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

Clever Phishing Attack Bypasses MFA to Nab Microsoft Office 365 Credentials

A new phishing campaign can bypass multi-factor authentication MFA on Office 365 to access victims’ data stored on the cloud and use it to extort a Bitcoin ransom or even find new victims to target, security researchers have found. Researchers at Cofense Phishing Defense Center discovered the...