gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

janusec

Janusec Application Gateway / JANUSEC应用网关 English Readme 提供快速、安全的应用交付 介绍PPT： https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf 主要功能 JANUSEC应用网关的主要功能有： 向Web应用提供统一的安全接入，包括HTTPS、身份认证、安全防御（WAF/CC）等。如Web应用是通过K8S Pods部署的，该网关也可以作为K8S Ingress Controller使用，向Pods提供跟普通Web应用同样的接入和安全特性。...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE

This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...

CVE-2026-73179

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

EUVD-2026-95695

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2026-73179

The Apache CXF JPA OAuth2 authorization code grant provider contains a race condition (CWE-367) due to non-atomic find-then-delete operations against a shared relational database under READ_COMMITTED isolation. This flaw allows a remote attacker to bypass single-use semantics and obtain multiple ...

CVE-2026-73179 Apache CXF: JPA authorization-code consume is non-atomic

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

kanidm

Kanidm - إدارة هوية بسيطة وآمنة حول Kanidm هي منصة إدارة هوية بسيطة وآمنة، تتيح للتطبيقات والخدمات الأخرى إسناد مهمة المصادقة وتخزين الهويات إلى Kanidm. الهدف من هذا المشروع هو أن يكون مزود هوية متكاملًا، يغطي أوسع مجموعة ممكنة من المتطلبات والتكاملات. لن تحتاج إلى أي مكونات أخرى مثل Keycloak عند...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner ماسح ضوئي غير تدخلي للثغرات الأمنية يعتمد على الإصدار، خاص بـ CVE-2026-4282 ، ويؤثر على Keycloak و Red Hat Build of Keycloak RHBK. ⚠️ إخلاء المسؤولية: هذه الأداة مخصصة حصريًا لأبحاث الأمن المصرح بها، واختبار الاختراق، وإدارة الثغرات الدفاعية. لا تشغّلها إلا على الأنظمة التي...

oauth2-proxy

OAuth2 Proxy هو أداة مرنة مفتوحة المصدر يمكنها العمل إما كخادم وسيط عكسي reverse proxy مستقل أو كمكوّن وسيط middleware مدمج في إعدادات الخوادم العكسية أو موازنات الأحمال الحالية. يوفر طريقة بسيطة وآمنة لحماية تطبيقات الويب الخاصة بك باستخدام مصادقة OAuth2 / OIDC. بصفته خادمًا وسيطًا عكسيًا، فإنه...

CVE-2026-11102-OAuth2-Implicit-Grant-Fragment-Hijacking

CVE-2026-11102 – اختطاف جزء المنح الضمني OAuth2 كود البرنامج Node.js + Exploit // oauthserver.js - OAuth2 provider issuing tokens in fragment const express = require'express'; const app = express; app.get'/authorize', req, res = const redirectUri = req.query.redirecturi; const state =...

cloudfoundry_uaa

CloudFoundry User Account and Authentication UAA Server The UAA is a multi tenant identity management service, used in Cloud Foundry, but also available as a stand alone OAuth2 server. It's primary role is as an OAuth2 provider, issuing tokens for client applications to use when they act on behal...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

kratos

चैट · चर्चाएँ · समाचार पत्रिका · दस्तावेज़ · Ory Network आज़माएँ · नौकरियाँ Ory Kratos क्लाउड नेटिव अनुप्रयोगों के लिए एक API-प्रथम पहचान और उपयोगकर्ता प्रबंधन प्रणाली है। यह लॉगिन, पंजीकरण, पुनर्प्राप्ति, सत्यापन और प्रोफ़ाइल प्रबंधन प्रवाहों को केंद्रीकृत करता है ताकि आपकी सेवाएँ उन्हें पुनः...

RabbitMQ Management - OAuth 2 Client Secret Disclosure

RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauthclientsecret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...