PYSEC-2026-1679 Moonraker affected by LDAP search filter injection

Impact Instances of Moonraker configured with the ldap component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover...

Moonraker affected by LDAP search filter injection

ImpactInstances of Moonraker configured with the ldap component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LD...

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

DescriptionThe OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

PYSEC-2026-1363 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

PYSEC-2026-1948 Open Redirect Vulnerability in Taguette

Summary An Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance b...

Open Redirect Vulnerability in Taguette

SummaryAn Open Redirect vulnerability exists in Taguette that allows attackers to craft malicious URLs that redirect users to arbitrary external websites after authentication. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance bu...

CKAN vulnerable to fixed session IDs

ImpactSession ids could be fixed by an attacker if the site is configured with server-side session storage CKAN uses cookie-based session storage by default. The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers a...

Fides has a Lack of Brute-Force Protections on Authentication Endpoints

SummaryThe Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or passwo...

PYSEC-2026-1335 Fides has a Lack of Brute-Force Protections on Authentication Endpoints

Summary The Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or...

Calibre Web and Autocaliweb have a ReDoS vulnerability

ReDoS in stripwhitespaces function in cps/stringhelper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24...

GO-2026-5866 Concourse login flow has an open redirect issue in github.com/concourse/concourse

Concourse login flow has an open redirect issue in github.com/concourse/concourse...

PYSEC-2026-1920 GHSL-2024-288: SickChill open redirect in login

SickChill is an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open...

NiceGUI On Air authentication issue

SummaryOnce a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impacthigh...

GHSL-2024-288: SickChill open redirect in login

SickChill is an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open...

Flask-AppBuilder's login form allows browser to cache sensitive fields

ImpactAuth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. PatchesUpgrade flask-appbuilder to version 4.5.1 WorkaroundsIf upgrading is not possible configure your web server to send the...

PYSEC-2026-1382 Flask-AppBuilder's login form allows browser to cache sensitive fields

Impact Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Patches Upgrade flask-appbuilder to version 4.5.1 Workarounds If upgrading is not possible configure your web server to send the...

PYSEC-2026-1669 MobSF vulnerable to Open Redirect in Login Redirect

Impact What kind of vulnerability is it? Who is impacted? An open redirect vulnerability exist in MobSF authentication view. PoC 1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser. 2. Enter credentials and press "Sign In". 3. You will be redirected to afine.com Users who are...

MobSF vulnerable to Open Redirect in Login Redirect

ImpactWhat kind of vulnerability is it? Who is impacted?An open redirect vulnerability exist in MobSF authentication view. PoC1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.2. Enter credentials and press "Sign In".3. You will be redirected to afine.comUsers who are not...

PYSEC-2026-1711 Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Summary and impactGoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domains.The...