4798 matches found
Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials
Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...
Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. id: CVE-2018-1000600...
SUSE CVE-2026-16615
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities
The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including: - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily...
PT-2026-64432
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description Any logged-in user can enumerate and retrieve email addresses and profile metadata including nicknames, avatars, creation time, and profile share-visibility of inactive or banned accounts. This...
PT-2026-64435
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An OAuth scope authorization bypass exists in the admin storage policy routes. A user with an OAuth bearer token scoped only to Admin.Read can access the 'POST /api/v4/admin/policy/oauth/signin'...
Improper Verification of Source of a Communication Channel
Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's...
PYSEC-2026-3467 garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...
EUVD-2026-42359
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback...
NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...
Incorrect Authorization
Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization in the OAuth 2.1 authorization. An attacker can gain unauthorized access to another user's workflow and execute it with the owner's credentials by registering an OAuth client and...
GHSA-Q5XF-XHWF-CWQF n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's n8n OAuth2-protected MCP...
CVE-2026-16615
The CVE affects librest where the PKCE implementation relies on GLib’s GRand PRNG, which is cryptographically insecure. This leads to insufficient entropy in the code verifier, enabling an attacker to reverse‑engineer the PRNG seed and predict or reconstruct the code verifier, thereby bypassing P...
EUVD-2026-47742
A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...
GHSA-5VFW-JC4P-FJ39 Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow w...
Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gq66-9cw5-j5jm. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based...
CVE-2026-65594
n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger...
CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check
n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger...