CVE-2026-102877

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

EUVD-2026-89412

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...

CVE-2026-102877

The Fider application (versions prior to 0.38.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a time-of-check time-of-use (TOCTOU) gap during URL validation for webhooks and custom OAuth provider endpoints. An attacker who controls DNS can utilize a DNS rebinding attac...

CVE-2026-101271

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271

In an unspecified software system, OAuth credentials (access tokens) remain valid for their full lifetime even after the associated OAuth client application has been manually disabled. This behavior allows for potential unauthorized access during the period between application deactivation and to...

EUVD-2026-88754

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

CVE-2026-5229

CVE-2026-5229 CVE-2026-5229: 通过 LINE OAuth 回调的 Form Notify 认证绕过 CVSS 9.8 Form Notify — LINE OAuth 认证绕过扫描器 插件: Form Notify form-notify 漏洞类型: Unauthenticated LINE OAuth Authentication Bypass → Account Takeover CVSS 分数: 9.8 严重 CVSS 向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 受影响版本: 'GET',...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86157

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

EUVD-2026-88649

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158

Progress Software Fiddler Everywhere 8.0.2 contains a vulnerability due to missing authentication in its local .NET backend (Fiddler.WebUi ). A local unauthenticated attacker can exploit unauthenticated localhost HTTP and SignalR RPC channels to mint OAuth tokens and read the machine-in-the-middl...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158 Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

EUVD-2026-88648

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-86157

Progress Telerik Fiddler Everywhere versions prior to 8.2.0 are vulnerable to the exposure of privileged IPC functionality . A local, low-privileged attacker who can modify application launch parameters and influence a user to start the application can replace the UI or settings with attacker-con...