7200 matches found
EUVD-2026-89929
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-97274
The WordPress OAuth Single Sign On – SSO (OAuth Client) plugin, versions
EUVD-2026-89923
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
CVE-2026-97274 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Bypass vulnerability vulnerability discovered by rpgsec in WordPress Plugin OAuth Single Sign On – SSO OAuth Client versions = 7.1.2...
WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...
CVE-2026-97288: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
PT-2026-103261
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
PT-2026-103255
Name of the Vulnerable Software and Affected Versions OAuth Single Sign On – SSO OAuth Client versions prior to 7.1.3 Description An authentication bypass exists in the OAuth Single Sign On – SSO OAuth Client plugin that is reachable pre-login. This allows unauthenticated attackers to forge a...
CVE-2026-97274: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
CVE-2026-102877
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
CVE-2026-102877
The Fider application (versions prior to 0.38.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a time-of-check time-of-use (TOCTOU) gap during URL validation for webhooks and custom OAuth provider endpoints. An attacker who controls DNS can utilize a DNS rebinding attac...
CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
EUVD-2026-89412
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
CVE-2026-102877 Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal...
CVE-2026-101271
OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...
CVE-2026-101271 OAuth credentials not disabled when application is disabled
OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...