CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE Race Condition Account Takeover Overview A race condition in the OAuth2 authorization server allows an attacker to reuse a victim’s authorization code before the legitimate client redeems it, by guessing or brute‑forcing the PKCE codeverifier within a small time...

Linux Distros Unpatched Vulnerability : CVE-2026-48717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the...

CVE-2026-48717

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717

OpenAM Community Edition (through 16.0.6) contains an Improper Authorization flaw (CWE-285) in its OAuth2 authorization-code grant flow. The token endpoint only validates code_verifier when the realm-wide codeVerifierEnforced setting is enabled—a setting that ships disabled by default . When an a...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

EUVD-2026-78369

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-48717: Improper Authorization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-73309: Incorrect Comparison

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-47775

Envoy OAuth2 filter vulnerability (CVE-2026-47775): prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the encrypt()/decrypt() path uses AES-256-CBC without an authentication tag (no HMAC/AEAD), enabling a padding oracle via the /callback endpoint. An attacker with the encrypted CodeVerifier ...

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

Am I affected? Users are affected if all of the following are true: - The application uses better-auth at a version below 1.6.2 or @better-auth/sso paired with such a version. - betterAuth account: storeStateStrategy is set to "cookie". The default "database" is not affected. - The application...

CVE-2026-41213

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

CVE-2026-41213: Improper Restriction of Excessive Authentication Attempts

@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...

Design/Logic Flaw

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....