CVE-2026-50157: Use of GET Request Method With Sensitive Query Strings

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...

PT-2026-91221

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.0 through 11.8.4 Mattermost versions 11.7.0 through 11.7.7 Description An issue exists where the software fails to validate Dynamic Client Registration redirect URIs by URL component, instead...

CVE-2026-90712: Improper Resource Shutdown or Release

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

PT-2026-91173

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

CVE-2026-90474

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90474

MCPHub before 1.0.32 is affected by an authentication bypass in its embedded OAuth 2.0 authorization server. The root cause is that client authentication is disabled by default and PKCE enforcement is optional , allowing an attacker who intercepts an authorization code to redeem it for an access ...

CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

EUVD-2026-76850

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-90474: Improper Authentication

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

PT-2026-90637

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...

CVE-2026-54072

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...

[SECURITY] Fedora 45 Update: perl-Net-OAuth-0.33-2.fc45

Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...

EUVD-2026-76187

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...

CVE-2026-18122 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

CVE-2026-18122 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

CVE-2026-18122

Concrete CMS versions 9.2.0 through 9.5.2 contain a Missing Authorization flaw in the Express REST API list endpoint . The Express entry collection endpoint disabled the per-entry view permission check, allowing an OAuth token with read scope for an Express entity to enumerate entries the user co...

CVE-2026-18122 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

EUVD-2026-75888

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...