ROADtools

ROADtools R ogue O ffice 365 和 A zure active D irectory 工具 ROADtools 是一个用于与 Azure AD 交互的框架。它包含一个库 roadlib 提供通用组件、ROADrecon Azure AD 探索工具以及 ROADtools Token eXchange roadtx 工具。 ROADlib ROADlib 是一个库，可用于与 Azure AD 进行身份验证，或构建与包含 ROADrecon 数据的数据库集成的工具。ROADlib 中的数据库模型基于 Azure AD 内部 API 的元数据定义自动生成。ROADli...

TokenMan

访问和刷新令牌套件。 Token Man 是一款使用 AAD 访问令牌和/或刷新令牌来支持后渗透活动的工具。 目录 用法 命令 Fetch Search Swap FOCI 应用程序客户端 ID 映射 AZ OAuth 用法 root@kitploit: usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -- v0.1.1 positional arguments: fetch,search,swap,az,oauth Command fetch Retrieve data via Graph API searc...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-88005

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

CVE-2026-88006

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

EUVD-2026-75541

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88006 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88006

Open WebUI (a self-hosted AI platform) is affected by an authentication bypass in its OAuth token exchange endpoint from version 0.8.0 through 0.11.1 . The endpoint issues a session for a provider access token without executing the OAuth role management that the normal login callback performs. As...

CVE-2026-88006 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88006 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88005

Open WebUI versions 0.8.0 through 0.9.0 are affected by a bypass in the OAuth token exchange endpoint . The endpoint issues a valid session for a provider access token without enforcing the email domain allowlist that the standard OAuth login callback applies. As a result, an account whose email ...

CVE-2026-88005 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

EUVD-2026-75540

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An accou...

CVE-2026-51416

1. 摘要 漏洞类型 ：拒绝服务 / 无限制 HTTP 响应读取（CWE-400） 标记位置 ：backend/internal/handler/authwechatoauth.go:1149 漏洞描述 ：微信 OAuth 令牌交换过程使用 io.ReadAllresp.Body 将完整的上游 HTTP 响应体读入内存，在缓冲之前未强制执行任何最大大小限制。 2. 分析 步骤 1：检查 backend/internal/handler/authwechatoauth.go:1124 处标记的接收点 已审查标记函数及其周围 50 多行上下文。接收点是令牌交换辅助函数...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89454

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

kit-oauth

kit-oauth KitアプリケーションのためのOAuth 2.0クライアントライブラリ TOC ファイル ファイル| 説明 ---|--- .editorconfig| エディタの書式設定 .gitignore| ビルド成果物と依存関係のGit無視ルール .tool-versions| asdfツールバージョン Zig, Kit LICENSE| MITライセンスファイル README.md| このファイル examples/client-credentials.kit| ドライランのクライアントクレデンシャル例 examples/github.kit|...

BIT-KEYCLOAK-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...