CVE-2026-73655

Trigger.dev prior to 4.5.2: addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring email_verified. When existingEmailUser && !existingUser is true, the flow writes th...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73655 Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73563 Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

CVE-2026-73563

Backstage CVE-2026-73563 affects the @backstage/plugin-auth-backend dynamic client registration and CIMD features. Before 0.29.2, full-string glob matching of auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and auth.experimentalClientIdMetadataDocuments patterns allowed a ho...

CVE-2026-73563 Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

CVE-2026-73563 Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for...

WeKan 6-digit invite codes can be brute-forced to take over invited accounts (InviteBleed)

WeKan 6-Digit Invite Codes Can Be Brute-Forced to Take Over Invited Accounts InviteBleed Vulnerability Overview In WeKan's invitation-based registration flow, invitees complete registration and account creation using a verification code from their email. Before the fix, two flaws compounded: firs...

WeKan OIDC login callback shares serviceData/profile, enabling concurrent account takeover (regression hardening)

WeKan OIDC Login Callback Shares Login Context, Enabling Concurrent Account Takeover Regression Hardening Vulnerability Overview In WeKan's OIDC OAuth2/OIDC login flow, the per-login identity context objects were once placed in a shared scope outside the login callback, so multiple concurrent OID...

WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)

WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...

CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...

CVE-2026-66465

CVE-2026-66465 affects WordPress Cartify theme (Cartify Multipurpose) versions up to and including 1.3.0.1, with unauthenticated broken authentication that can lead to account takeover. The connected documents confirm the vulnerability type and the affected version range but do not provide remedi...

CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...

CVE-2026-66453

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-19088

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...