onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 계정 선점 하이재킹 PocketBase 인증 컬렉션에서 OAuth2가 활성화되면 클라이언트가 가입 시 createData 객체를 전달할 수 있습니다. createData 안의 이메일은 OAuth2 제공자가 확인한 이메일과 비교되지 않습니다. 구성된 제공자에 계정이 있는 사람은 자신의 OAuth2 ID에 연결된 타인의 이메일을 포함하는 레코드를 등록할 수 있습니다. 하나의 제공자가 구성된 경우 실제 소유자는 잠깁니다. 두 개 이상인 경우 소유자는 나중에 다른 제공자를 ...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

UBUNTU-CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662 Nodemailer before 8.0.8 TLS Certificate Validation Bypass

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662 Nodemailer before 8.0.8 TLS Certificate Validation Bypass

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

EUVD-2026-68440

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js via rejectUnauthorized: false. This allows an attacker in a machine-in-the-middle position to intercept OAuth2 token requests over compromised HTTPS connections, capturing OAuth client secrets , refresh tokens , a...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC: захват учетной записи Доказательство концепции для CVE-2026-49757 — критической уязвимости в AshAuthentication, в которой OAuth2/OIDC-обратные вызовы разрешались в локальные учетные записи по адресу электронной почты вместо пары идентификаторов...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – Гонка состояний в OAuth2 PKCE захват учётной записи Обзор Гонка состояний в сервере авторизации OAuth2 позволяет атакующему использовать код авторизации жертвы до того, как его погасит легитимный клиент, путём подбора или перебора codeverifier в пределах небольшого временного...

Linux Distros Unpatched Vulnerability : CVE-2026-82662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2...

oauth-scan

OAUTHScan Описание OAUTHScan — это расширение Burp Suite, написанное на Java, предназначенное для выполнения автоматических проверок безопасности, которые могут быть полезны при пентесте приложений, реализующих стандарты OAUTHv2 и OpenID. Плагин выявляет различные уязвимости OAUTHv2/OpenID и...

gitea-CVE-2026-28699

CVE-2026-28699: HTTP Basic Auth के माध्यम से Gitea OAuth2 Scope Bypass जब एक Gitea OAuth2 एक्सेस टोकन, जो केवल read:user तक सीमित है, को Bearer टोकन के बजाय Authorization: Basic base64:x-oauth-basic के रूप में भेजा जाता है, तो वह पूर्ण लेखन क्रियाएँ कर सकता है। Basic auth के माध्यम से प्रस्तुत कि...

OAUTHScan

OAUTHScan Descrizione OAUTHScan è un'estensione di Burp Suite scritta in Java con l'obiettivo di fornire alcuni controlli di sicurezza automatici, che possono essere utili durante il penetration testing di applicazioni che implementano gli standard OAUTHv2 e OpenID. Il plugin cerca varie...

Linux Distros Unpatched Vulnerability : CVE-2026-73208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the...

Linux Distros Unpatched Vulnerability : CVE-2026-40205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the...

CVE-2026-11102-OAuth2-Implicit-Grant-Fragment-Hijacking

CVE-2026-11102 – Dirottamento del frammento nel flusso implicito OAuth2 Codice del programma Node.js + Exploit root@kitploit: // oauthserver.js - OAuth2 provider issuing tokens in fragment const express = require'express'; const app = express; app.get'/authorize', req, res = const redirectUri =...

AZL-98295 CVE-2026-73208 affecting package dovecot 2.3.20-1

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

ALPINE-CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...