120 matches found
CVE-2026-67581
ZenHive mpp (Elixir HTTP 402 payment library) versions 0.3.0 through before 0.6.3 contain an authentication bypass by capture-replay in the EVM payment method. The function MPP.Methods.EVM.verify/2 matches a transfer solely on token, recipient, and amount without binding the proof to the specific...
CVE-2026-45734
MyBB versions before 1.8.40 fail to call captcha::invalidate_captcha() in five endpoints (contact.php, member.php actions, sendthread.php), allowing a valid CAPTCHA response to be replayed for low-integrity abuse (spam, password reset floods). CVSS 5.3 MEDIUM. Fixed in 1.8.40; no in-the-wild expl...
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer src/node/hooks/express/tokenTransfer.ts that lets a logged-in user move their...
PT-2026-76574
Name of the Vulnerable Software and Affected Versions Etherpad versions 2.6.0 through 3.0.0 Description An issue exists in the device-to-device author-token transfer mechanism. The system uses the POST /tokenTransfer endpoint to store an author token and exposes it via the GET /tokenTransfer/uuid...
CVE-2026-73431
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...
EUVD-2026-57226
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...
CVE-2026-73431
CVE-2026-73431 affects Vulnerability-Lookup's account activation and password-recovery flows. The system issued stateless signed tokens containing only the user login; while signatures and token age are checked, there was no check that a token had already been used. As a result, a valid activatio...
CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...
PT-2026-71094
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...
CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...
MAL-2026-11138 Malicious code in json-schema-inspector (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023b104d04c30fccd05f5db5842a2d8735c572eb13cfbb5ca7ba763eeb525429 The package advertises itself as a JSON/XML schema validator, but both public entry points validateJson, validateXml in lib/core.js invoke a trigger...
CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the authorizationcode grant handler. An attacker can obtain multiple valid access,...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the authorizationcode grant handler. An attacker can obtain multiple valid access...
PT-2026-56302
Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions 1.6.0 through 1.6.10 better-auth versions 1.4.8-beta.7 through 1.6.10 Description The POST /oauth2/token endpoint for the authorization code grant redeems a single-use authorization code using a non-atomic...
Replay Attack
Overview Affected versions of this package are vulnerable to Replay Attack due to improper enforcement of OAuth2 authorization code expiry and single-use requirements in the authorization code process. An attacker can gain unauthorized access by reusing valid authorization codes during the token...
CVE-2026-26232
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
CVE-2026-26232 Gitea OAuth2 authorization codes lack expiry and reuse enforcement
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...