389 matches found
CVE-2026-123528
Vikunja versions before 2.7.1 are vulnerable to an insufficient session expiration flaw due to the SetupTokenMiddleware skipping necessary session and account-status checks. This allows holders of revoked access tokens to maintain authentication. Specifically, an attacker with a stolen token can ...
CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...
CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...
CVE-2026-123528: go-vikunja vikunja: Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access…
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...
EUVD-2026-116594
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...
PT-2026-136838
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The system fails to properly enforce scope authorization when the authorize all scopes configuration is enabled. This allows applications using the client...
CVE-2026-121736
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...
CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...
CVE-2026-121736 NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...
CVE-2026-121736
NocoDB versions 0.300.0 before 2026.08.0 are affected by a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler. This flaw allows unauthenticated attackers to send anonymous requests containing client_id, redirect_uri, and approved=true to create unbounded ownerless OA...
CVE-2026-121736
NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with clientid, redirecturi and approved=true to insert...
GHSA-MHF7-XP6R-6QRC Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...
PT-2026-135861
Impact Three issues allowed actions protected by the Authorize attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. Authorize resolved a model parameter by its array key, while the action itself received parameters positionally. A...
CVE-2026-111898
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...
CVE-2026-111898
phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass due to implicit account linking with Keycloak . An attacker controlling a Keycloak identity with a colliding preferred_username or an unverified email can exploit this flaw by logging in through the /auth/k...
CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...
CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...
EUVD-2026-103321
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...
CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through...