CVE-2026-63127

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. The OAuth implementation in rmcp omits the RFC 9728 resource field from ResourceServerMetadata. This allows a malicious Model Context Protocol MCP server to publish metadata for a different legitimate MCP resource. Consequently,...

keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

keycloak-services: keycloak-services: Microsoft external access-token exchange bypasses configured tenant

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

keycloak-services: keycloak-services: Google external access-token exchange bypasses hosted-domain restriction

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-63127

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

EUVD-2026-80824

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-63127

RMCP is the official Rust SDK for the Model Context Protocol . Prior to version 2.0.0 , the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-...

CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discoveroauthserverviaresourcemetadata to use protected-resource metadat...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The Jenkins Bitbucket Server Integration Plugin (atlassian-bitbucket-server-integration) versions 6.0.1 and earlier is vulnerable to an OAuth access token hijacking flaw. The OAuth authorization endpoint incorrectly reads the oauth_callback URL from the submitted form instead of using the server-...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80008

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via uploadmarkdown enables PAT exfiltration and full account takeover...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration due to the Core API accepting existing, unexpired tokens for accounts that have been deactivated by an...

Incorrect Authorization

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Incorrect Authorization in the unauthenticated token endpoint, which accepts a client-credentials grant for any confidential...