CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

Apache Airflow security vulnerabilities

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. However, Apache Airflow has security vulnerabilities. The...

PT-2026-37128

Name of the Vulnerable Software and Affected Versions Nhost versions prior to 0.49.1 Description Nhost automatically links incoming OAuth identities to existing accounts when email addresses match, provided the email is marked as verified. Several provider adapters fail to correctly populate the...

PT-2026-35602

Summary Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The...

CVE-2026-40948: Cross-Site Request Forgery (CSRF)

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2026-40303

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls makestring, count with no upper bound before any token validation occurs. The function is reached on every request t...

CVE-2026-40302

CVE-2026-40302 affects zrok prior to v2.0.1. The proxyUi template engine used Go's text/template (no HTML escaping), leading to reflected XSS via an attacker-controlled refreshInterval error rendered in the GitHub OAuth callback. An attacker can send a crafted login URL; after OAuth completes, th...

CVE-2026-40302 zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

CVE-2026-40302 zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

CVE-2026-40302 zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

org.jenkins-ci.plugins:saml (>=0.3, <=0.6), org.pac4j:pac4j-cas (1.6.0-rc1) +9 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.6.0-rc1)

org.pac4j:pac4j-core MAVEN version 1.6.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.jenkins-ci.plugins:saml =0.3, =0.6 - org.pac4j:pac4j-cas 1.6.0-rc1 - org.pac4j:pac4j-gae 1.6.0-rc1 -...

org.pac4j:pac4j-cas (1.7.2), org.pac4j:pac4j-gae (1.7.2) +6 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.7.2)

org.pac4j:pac4j-core MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.7.2 - org.pac4j:pac4j-gae 1.7.2 - org.pac4j:pac4j-http 1.7.2 - org.pac4j:pac4j-oauth 1.7.2 -...

org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...

io.ratpack:ratpack-pac4j (>=1.2.0-rc-1, <=1.3.3), net.binggl:ninja-google-oauth-module (>=1.0.2, <=1.0.3) +16 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.5)

org.pac4j:pac4j-core MAVEN version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - io.ratpack:ratpack-pac4j =1.2.0-rc-1, =1.0.2, =1.0.3 - org.pac4j:j2e-pac4j 1.2.2 - org.pac4j:pac4j-cas 1.8.5 -...

org.pac4j:pac4j-cas (4.5.3), org.pac4j:pac4j-config (4.5.3) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.3)

org.pac4j:pac4j-core MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.3 - org.pac4j:pac4j-config 4.5.3 - org.pac4j:pac4j-couch 4.5.3 - org.pac4j:pac4j-gae 4.5.3 -...

CVE-2025-15622 Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication fl...

CVE-2026-40302: Improper Neutralization of Input During Web Page Generation

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

PT-2026-33633

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 4.1.0 through 4.1.1 Description An authentication bypass exists because the default broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. This cla...

PT-2026-33423

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication fl...

PT-2026-33644

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 3.9.2 Apache Kafka versions prior to 4.0.1 Description The NetworkClient component outputs complete request and response information when the log level is set to DEBUG. While the default log level is INFO, enabli...