CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...

CVE-2023-2193 Oauth authorization codes do not expire when deauthorizing an oauth2 app

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token...

CVE-2023-2193

Mattermost OAuth2: CVE-2023-2193 describes a flaw where deauthorizing an OAuth2 app fails to invalidate existing authorization codes. An attacker who possesses a valid authorization code can use it to obtain an access token, enabling unauthorized access. Affected product: Mattermost Server (vario...

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...