CVE-2026-7465-Lab

CVE-2026-7465 - Spectra Gutenberg Blocks 로컬 랩 WordPress 플러그인 Spectra Gutenberg Blocksultimate-addons-for-gutenberg의 CVE-2026-7465를 분석하고 재현하기 위한 로컬 Docker 랩입니다. 이 랩은 다음을 비교합니다: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 이 증명PoC은 의도적으로 최소 피해least-harm 방식입니다. 셸 명령을 실행하거나, 파일을 업로드하거나, 사용자를 생성하거나,...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506

Medplum , a developer platform for healthcare apps, had a flaw in versions 4.1.10 through 5.1.6 affecting self-hosted configurations . The /oauth2/register endpoint (OAuth dynamic registration) could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients serve...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476

doorkeeper-openid_connect (an OpenID Connect extension for the Doorkeeper OAuth 2 gem in Ruby on Rails) is affected in version 1.9.0 . The root cause is in DynamicClientRegistrationController#register, which hard-codes confidential: false when creating dynamically registered applications, yet sti...

CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

The vulnerability of the final point of contact for the dynamic registration mechanism of the OAuth2 software used to manage medical organizations like OpenEMR, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the final point of contact for the dynamic registration mechanism of the OAuth2 software used to manage medical organizations like OpenEMR lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to gain unauthoriz...

CVE-2026-67610

OpenEMR 8.2.0 is affected by an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint. Attackers can unauthenticatedly register a malicious client by supplying a self-generated RSA keypair in the jwks field, leveraging system-level FHIR scopes. After an administ...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-65635

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-54885

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...

PT-2026-66494

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register client/3 forwards caller-supplied...

@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

CVE-2026-45609

CVE-2026-45609 concerns the mcp-security component of Spring AI, where unvalidated URL fetching enables SSRF prior to version 0.1.9. The vulnerability affects installations with Dynamic Client Registration (DCR) enabled and involves processing untrusted URLs used for OAuth-related discovery and m...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated URL processing in the OAuth2 dynamic client registration process. An attacker can access internal network resources or sensitive information by supplying malicious URLs to be fetched by t...

CVE-2026-31587

A flaw was found in the Linux kernel, specifically within the ASoC ALSA System on Chip qcom q6apm component. This vulnerability arises from incorrect memory management during the dynamic registration of digital audio interface DAI components. When both the component and its associated DAIs are...

CVE-2026-1180

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...