2838 matches found
CVE-2026-64859
In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...
Race Condition
Apache CXF is vulnerable to a Race Condition. The vulnerability is due to improper synchronization when validating and consuming refresh tokens, which allows concurrent requests using the same leaked refresh token to bypass single-use restrictions and generate multiple valid access tokens...
CVE-2025-27621: Improper Authentication
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
PT-2026-76670
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...
Basecamp: One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML
A cross-account JavaScript execution vulnerability was discovered in a web application that allowed arbitrary code execution when a victim opened a crafted public board URL. An attacker with a separate account could leverage this vulnerability to steal the victim's write access token through a...
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-56654
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
EUVD-2026-58171
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
CVE-2026-58429
The Git repository management system Gitea is vulnerable to an access control deficiency in its Organization and Permission Endpoints (specifically /api/v1/user/orgs and /api/v1/users/{username}/orgs/{org}/permissions). This vulnerability allows for a Personal access tokens scope bypass , which c...
EUVD-2026-58143
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-56654
The Gitea Project is affected by CVE-2026-56654 , a Critical severity vulnerability allowing for Privilege Escalation via Access Token Scope Escalation within the API. An attacker can manipulate the scope of an access token to gain unauthorized access to sensitive functions or data, potentially l...
CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
Privilege Escalation via Access Token Scope Escalation in API...
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...
Insufficient Session Expiration
Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...