HackerOne: Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone

Improper CSRF token validation in HackerOne's integration authentication server allowed attackers to access victim's accounts linked to HackerOne. This vulnerability was due to the flawed authorization flow in which the CSRF token was not properly validated, making it possible for attackers to...

CVE-2021-41598

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

CVE-2021-41598

GitHub Enterprise Server vulnerability CVE-2021-41598 is a UI misrepresentation flaw in the GitHub App authorization flow. It can cause more permissions to be granted than the user sees during approval, specifically if the user later updates the repositories an app is installed on after additiona...

Mattermost Server 跨站脚本漏洞

Mattermost Server is an open source messaging platform from Mattermost, Inc. A cross-site scripting vulnerability exists in Mattermost Server, which stems from the lack of proper authentication of client-side data in OAuth-enabled Mattermost instances, and could be exploited to lure users into...

UBUNTU-CVE-2021-22213

A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari...

CVE-2021-27582

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

CVE-2021-27582

MITREid Connect OpenID Connect server (MITREid Connect) before 1.3.3 is affected by a Mass Assignment (Autobinding) vulnerability in OAuthConfirmationController.java. The issue arises from unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, allowing HTTP request pa...

UBUNTU-CVE-2020-13300

GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow...

PT-2020-13441 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.3 through 13.3.3 Description: The issue concerns an OAuth authorization scope change without user consent in the middle of the authorization flow. Recommendations: For GitLab CE/EE versions 13.3 through 13.3.3, update...

CVE-2020-11691

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible...

PT-2019-5406 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7, openshift-enterprise-3.9 through 3.11 Description: A reflected XSS issue exists in the authorization flow, allowing an attacker to steal...

Doorkeeper::OpenidConnect Open Redirect

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...

CVE-2019-9837

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...

CVE-2019-9837

The CVE-2019-9837 issue affects Doorkeeper::OpenidConnect (OpenID Connect extension for Doorkeeper) versions 1.4.x and 1.5.x prior to 1.5.4. An open redirect can occur via the redirect_uri field in an OAuth authorization request when the request includes the 'openid' scope and prompt=none, potent...

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

python-oauth2: Uses poor PRNG in nonce

It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...