CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358: Improper Authentication

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

DEBIAN-CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-96762: Authorization Bypass Through User-Controlled Key

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...

Linux Distros Unpatched Vulnerability : CVE-2026-92289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in PKCE or secret mode because...

CVE-2026-96762 kvcache-ai mooncake RPC Path UnmountSegment authorization

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...

CVE-2026-77268

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77268

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77250

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a...

CVE-2026-77250

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable in versions prior to 0.22.0 . The OAuthConfig component writes a fallback file containing plaintext access and refresh tokens into the .mcp-atlassian directory using process-default permissions . On systems with...

EUVD-2026-78817

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or...

CVE-2026-54450

ToolHive is a Go utility for deploying and managing Model Context Protocol (MCP) servers. Prior to v0.29.1 , the SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, causing NAT64-encoded private addresses to be classified...

CVE-2026-3367: Improper Neutralization of Input During Web Page Generation

The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...

GHSA-H29V-HJ44-Q8CV Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

CVE-2026-15318 Sipeed PicoClaw MQTT Channel mqtt.go authorization

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument clientid causes incorrect authorization. The attack is possible to be...

CVE-2026-46414: Authentication Bypass by Spoofing

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in task messages. A client connection can register as a normal device, but later send a TASK...