GHSA-XCX6-JX8P-X3H5 MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-18346

The TikTok for Business WordPress plugin (all versions up to 1.4.1 ) is vulnerable to authorization bypass via the auth_code parameter. The plugin fails to verify that the requester is authorized before processing a token exchange, allowing an unauthenticated attacker to overwrite the merchant's ...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...