25 matches found
CVE-2026-7465-Lab
CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...
CVE-2026-44506
Medplum , a developer platform for healthcare apps, had a flaw in versions 4.1.10 through 5.1.6 affecting self-hosted configurations . The /oauth2/register endpoint (OAuth dynamic registration) could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients serve...
CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...
CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...
CVE-2026-59354
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...
CVE-2026-44476
doorkeeper-openid_connect (an OpenID Connect extension for the Doorkeeper OAuth 2 gem in Ruby on Rails) is affected in version 1.9.0 . The root cause is in DynamicClientRegistrationController#register, which hard-codes confidential: false when creating dynamically registered applications, yet sti...
CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...
CVE-2026-67610
OpenEMR 8.2.0 is affected by an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint. Attackers can unauthenticatedly register a malicious client by supplying a self-generated RSA keypair in the jwks field, leveraging system-level FHIR scopes. After an administ...
CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...
CVE-2026-65635
Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...
CVE-2026-54885
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
PT-2026-66494
Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register client/3 forwards caller-supplied...
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...
CVE-2026-45609
CVE-2026-45609 concerns the mcp-security component of Spring AI, where unvalidated URL fetching enables SSRF prior to version 0.1.9. The vulnerability affects installations with Dynamic Client Registration (DCR) enabled and involves processing untrusted URLs used for OAuth-related discovery and m...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated URL processing in the OAuth2 dynamic client registration process. An attacker can access internal network resources or sensitive information by supplying malicious URLs to be fetched by t...
CVE-2026-31587
A flaw was found in the Linux kernel, specifically within the ASoC ALSA System on Chip qcom q6apm component. This vulnerability arises from incorrect memory management during the dynamic registration of digital audio interface DAI components. When both the component and its associated DAIs are...
CVE-2026-1180
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...
Fedora: Security Advisory for golang-k8s-kube-aggregator (FEDORA-2022-37aef44d1e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
