MAL-2025-2397 Malicious code in oauth2-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cc95085eb1819e853bafa9792a2e3d1b7b761fd85657e25b110586cbb78d997 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-22868

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2025-22868

A vulnerability exists in the golang.org/x/oauth2/jws component, where an attacker can provide a maliciously malformed token that leads to unexpected memory consumption during the parsing process. This issue affects several products, including cri-tools , docker-stable , and opentelemetry-collect...

CVE-2025-22868 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...

OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

Provides OAuth2 server functionality based on the oauth2-server-php library. The module does not consistently enforce admin configurations allowing users on a disabled server to still authenticate...

DRUPAL-CONTRIB-2025-013

This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling a client. This vulnerability is mitigated by the fact that an...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

CVE-2024-38371

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been...

CVE-2024-45596

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId...

CVE-2024-37300

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because allowall di...

OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling a client. This vulnerability is mitigated by the fact that an...

FreeBSD : oauth2-proxy -- Non-linear parsing of case-insensitive content (258a58a9-6583-4808-986b-e785c27b0a18)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 258a58a9-6583-4808-986b-e785c27b0a18 advisory. Golang reports: This update include security fixes: Tenable has extracted the preceding description blo...

WS-2021-0165

A security vulnerability was found in github.com/ory/oathkeeper 0.38.0-beta.2 before 0.38.12-beta.1. Possible bypass of token claim validation when OAuth2 Introspection caching is enabled...

oauth2-proxy -- Non-linear parsing of case-insensitive content

Golang reports: This update include security fixes: CVE-2024-45338: Non-linear parsing of case-insensitive content...

Malicious code in oauth2-jwt-bearer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 36fb17415b72312cf7dda66e2cfcb35ec7340bb75ae0fd7dfe1b3821f8039579 The OpenSSF Package Analysis project identified 'oauth2-jwt-bearer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-12104 Malicious code in oauth2-jwt-bearer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 36fb17415b72312cf7dda66e2cfcb35ec7340bb75ae0fd7dfe1b3821f8039579 The OpenSSF Package Analysis project identified 'oauth2-jwt-bearer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

forgejo -- unauthorized user impersonation

Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...

forgejo -- multiple vulnerabilities

Problem Description: When Forgejo is configured to run the internal ssh server with server.STARTSSHSERVER=true, it was possible for a registered user to impersonate another user. The rootless container image uses the internal ssh server by default and was vulnerable. A Forgejo instance running fr...