133 matches found
CVE-2026-39912
CVE-2026-39912 - Xboard / V2Board 未認証アカウント乗っ取り loginWithMailLink におけるマジックリンクトークンの漏洩 | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 重大 CWE| CWE-201 送信データへの機密情報の挿入 影響を受けるバージョン| V2Board = 1.6.1 から 1.7.4 まで / Xboard 0.1.9+ までの全バージョン 修正状況| 未修正 V2Board は2023年6月以降開発停止 公開日| 2026-04-09 発見者| Valentin Lobstein...
CVE-2023-52268
FreeScout End-User Portal 認証バイパスエクスプロイト CVE-2023-52268 概要 このエクスプロイトは、FreeScout End-User Portal モジュール （バージョン 1.0.65...
CVE-2026-82761
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
EUVD-2026-81480
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
CVE-2026-82761
AshAuthentication (by team-alembic) is vulnerable to a TOCTOU race condition that allows concurrent redemptions of a single-use magic link token. The sign-in flow verifies the JWT via Jwt.verify/4 and revokes it only in an after_action or after_transaction hook, after the sign-in has already comm...
EEF-CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Summary Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is mean...
CVE-2026-82761: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...
CVE-2026-62862
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...
CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...
CVE-2026-62862
Typebot (open-source chatbot builder), self-hosted versions ≤ 3.17.1 , is vulnerable to account takeover via brute-forcing of the passwordless email magic-link login code. The root cause is a 6-digit code generated with Math.random() (only 900,000 combinations) with a 10-minute expiry, no attempt...
EUVD-2026-66123
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...
CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...
CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...
CVE-2026-66882
Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...
CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...
EEF-CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms
Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthenticatio...
EUVD-2026-65321
Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...