61 matches found
CVE-2026-19202
The mcp-toolbox-sdk-python SDK contains a caching flaw within its toolbox-core package. The module-level token cache fails to uniquely key Google ID tokens by the requested audience. If an application authenticates to multiple audiences (e.g., Service A and Service B) within the same process, a v...
CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-84685
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...
EUVD-2026-74190
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...
CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-84685
The react-native-auth0 SDK 's web platform implementation fails to scope its in-memory token cache to individual user sessions in server-side rendering (SSR) environments where module state persists across HTTP requests. As a result, tokens cached in module memory can be retrieved by subsequent r...
EUVD-2026-74189
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
PT-2026-88449
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-84685: Exposure of Data Element to Wrong Session
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-86492
JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...
EUVD-2026-72508
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...
CVE-2026-86492: Exposure of Data Element to Wrong Session
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
PT-2026-86864
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-54779 CoreWCF: SAML token replay protection is inoperative
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captur...