ROADtools

ROADtools R ogue O ffice 365 and A zure active D irectory tools ROADtools is a framework to interact with Azure AD. It consists of a library roadlib with common components, the ROADrecon Azure AD exploration tool and the ROADtools Token eXchange roadtx tool. ROADlib ROADlib is a library that can ...

EUVD-2026-97672

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

CVE-2026-109374

ZITADEL versions 3.0.0 before 4.19.2 are vulnerable to a privilege escalation flaw within the OIDC token exchange process. The root cause is a failure to properly validate the admin.impersonation check, allowing users with IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles to bypass res...

EUVD-2026-97585

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-109283

Open WebUI versions 0.11.1 before 0.11.4 are vulnerable to an authorization bypass in the OAuth token exchange endpoint. The flaw occurs because the system only reads role claims from the provider's userinfo response and retains the user's existing role if no new claim is found, failing to accoun...

TokenMan

Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. Table of Contents Usage Commands Fetch Search Swap FOCI Application Client ID Map AZ OAuth Usage usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -...

CVE-2026-51416

1. Summary Vulnerability Type : Denial of Service / Unrestricted HTTP Response Reading CWE-400 Flagged Location : backend/internal/handler/authwechatoauth.go:1149 Vulnerability Description : The WeChat OAuth token exchange process uses io.ReadAllresp.Body to read the full upstream HTTP response...

kit-oauth

kit-oauth OAuth 2.0 client library for Kit applications TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit LICENSE| MIT license file README.md| This file...

CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...

PYSEC-2026-4129 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...

PYSEC-2026-4119 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105868

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

EUVD-2026-86530

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

The Keycloak-services component contains a vulnerability where the new Standard Token Exchange V2 feature fails to validate the digital certificate required for mTLS holder-of-key binding . This flaw allows an attacker possessing stolen client credentials to obtain a standard, unrestricted token,...