365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

langflow-cors-scanner

CVE-2025-34291 — Langflow Origin Validation / CORS Overview Overly permissive CORS config combined with refresh token cookie config allows credential theft. Field| Value ---|--- CVE| CVE-2025-34291 Severity| HIGH Product| Langflow CISA KEV| 2026-05-21 Attack Type| Origin Validation / CORS Auth...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

TokenTacticsV2

/ / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku. Azure JSON Web...

TokenMan

Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. Table of Contents Usage Commands Fetch Search Swap FOCI Application Client ID Map AZ OAuth Usage usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -...

JFrog Artifactory < 7.146.27 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.27. It is, therefore, affected by a privilege escalation vulnerability in the refresh-token signature due to incorrect validation. An authenticated, remote attacker can...

CVE-2025-7043 Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

CVE-2025-7043

The ForgeRock client is vulnerable to a validation flaw where refresh tokens are incorrectly treated as valid access tokens . This allows an attacker with a stolen or exposed refresh token to bypass the required client credential exchange flow and directly consume protected resources. This vulner...

PT-2026-117476

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

PYSEC-2026-4315 wger: API credentials remain valid after logout/password change

Summary A vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue ...

wger: API credentials remain valid after logout/password change

SummaryA vulnerability exists in the authentication/session lifecycle of wger where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken Authorization: Token ... or JWT refresh token can continue t...

BIT-GITEA-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-107761

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...

CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108716

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108716: Cleartext Transmission of Sensitive Information

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

CVE-2026-104084

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084 SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...