authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-28498 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2026-28498 Source advisory: OSV:GHSA-M344-F55W-2M6J...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-28498 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-28490 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-28490 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2026-28490 Source advisory: OSV:GHSA-7432-952R-CW78...

GHSA-5H2M-4Q8J-PQPJ FastMCP OAuth Proxy token reuse across MCP servers

While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for this MCP server, the token is issued for the baseurl passed to...

BIT-PARSE-2026-32242 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1386)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them globally an...

SUSE CVE-2017-18917

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens...

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability Impact The Microsoft.Bcl.Memory package, a transitive dependency of idunno.AtProto and idunno.AtProto.OAuthCallback had a Denial of Service security vulnerability, CVE-2026-26127 Patches v1.7.0 updates...

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Impact The OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value is sent to the token introspection endpoint instead of the user's actual access token. Depending on the introspection endpoint's...

CVE-2026-22203

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret...

PT-2026-25143

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret...

CVE-2026-22203: Exposure of Sensitive Information to an Unauthorized Actor

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret...

CVE-2026-31944: Missing Authentication for Critical Function

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...

CVE-2026-32235

An allowlist bypass flaw has been discovered in the npm @backstage/plugin-auth-backend package. Instances that have enabled experimental Dynamic Client Registration or Client ID Metadata Documents and configured allowedRedirectUriPatterns are affected. A specially crafted redirect URI can pass th...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CVE-2026-32269

Parse Server vulnerability CVE-2026-32269 affects deployments using the OAuth2 adapter with both appidField and appIds configured. The issue stems from incorrect validation of app IDs where a malformed value is sent to the token introspection endpoint instead of the user’s actual access token, po...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a malformed value ...

CVE-2026-32242

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. Under concurrent...