Important: Red Hat Security Advisory: dovecot security, bug fix, and enhancement update

An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — Toma de control de cuentas OAuth2/OIDC de AshAuthentication Prueba de concepto para CVE-2026-49757 — una vulnerabilidad crítica en AshAuthentication donde los callbacks OAuth2/OIDC resolvían las cuentas de usuario locales por dirección de correo electrónico en lugar del par de...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

PT-2026-107187

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OAuth2 and OpenID Connect sign-in paths fail to require a WebAuthn challenge when WebAuthn is the only configured second factor for an account. This allows an attacker who can authenticate...

PT-2026-107291

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OAuth2 token endpoint fails to verify if a token submitted with the refresh token grant type is actually a refresh token. This allows an unexpired access token for the same OAuth2 applicati...

[SECURITY] [DLA 4822-1] ruby-oauth2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4822-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 05, 2026 https://wiki.debian.org/LTS -...

CVE-2026-29198-POC

CVE-2026-29198-POC Rocket.Chat OAuth2 NoSQL 注入，影响 Rocket.Chat 版本 8.3.0、8.2.1、8.1.2、8.0.3、7.13.5、7.12.6、7.11.6 和 7.10.9 安装依赖： pip3 install -r requirement.txt 利用： python3 poccve202629198.py --url domain --escalate -v...

gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 作用域绕过（通过 HTTP Basic Auth） 仅具有 read:user 作用域的 Gitea OAuth2 访问令牌，若以 Authorization: Basic base64:x-oauth-basic 格式发送（而非 Bearer 令牌），则可执行完整的写操作。任何通过 Basic 认证提交的令牌都将跳过作用域检查。 受影响版本： HTTP 403 blocked Basic PATCH /api/v1/user/settings - HTTP 200 ALLOWED -- scope BYPASSED...

Debian dla-4822 : ruby-oauth2 - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4822 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4822-1 [email protected] https://www.debian.org/lts/security/...

oauth-scan

OAUTHScan Descripción OAUTHScan es una extensión de Burp Suite escrita en Java con el objetivo de proporcionar algunas comprobaciones de seguridad automáticas, que pueden ser útiles durante las pruebas de penetración en aplicaciones que implementan los estándares OAUTHv2 y OpenID. El plugin busca...

CVE-2020-10770-keycloak-exploit-poc

POC de SSRF Ciego en Keycloak Este es un recorrido paso a paso sobre cómo probar el SSRF ciego CVE-2020-10770 encontrado por Lauritz Holtmann y documentado en su entrada de blog. También explicó brevemente cómo probarlo. Esto es solo una explicación más detallada. Todo el crédito es para Lauritz...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 账户预劫持 启用 OAuth2 的 PocketBase 认证集合允许客户端在注册时传递 createData 对象。此对象中的电子邮件地址从未与 OAuth2 提供商验证的电子邮件进行核对。任何在已配置提供商上拥有账户的人都可以注册一条记录，该记录携带他人的电子邮件，并链接到自己的 OAuth2 身份。 若只配置了一个提供商，真实所有者将被锁定。若配置了两个或更多，所有者后续通过不同提供商登录，最终会与攻击者共享账户。 受影响版本：= 0.30.0, 受害者拥有账户 3...

CVE-2026-105119

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-105118

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...