CVE-2026-62213

OpenClaw versions prior to 2026.5.27 contain a token leakage vulnerability tied to MS Teams outbound requests. The issue allows lower-trust callers to access Bot Framework tokens by reaching configured input paths that should remain within the trusted boundary. Impact is exposure of credentials; ...

CVE-2026-62205: Missing Authorization

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

CVE-2026-62213: Insufficiently Protected Credentials

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary...

CVE-2026-62212: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should hav...

CVE-2026-62224: Authentication Bypass by Spoofing

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...

CVE-2026-41405: Incorrect Behavior Order: Early Amplification

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks...

CVE-2026-41365: Unintended Proxy or Intermediary

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions...

CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets

Mattermost Plugins versions =2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606...

CVE-2026-28481: Insertion of Sensitive Information Into Sent Data

OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader optional extension must be enabled that leaks bearer tokens to allowlisted suffix domains. When retrying downloads after receiving 401 or 403...

CVE-2025-27936 Webhook Secret Exposure via Timing attack in MSteams plugin

Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...

Black Basta Ransomware Uses MS Teams, Email Bombing to Spread Malware

The Black Basta ransomware group is using advanced social engineering tactics and a multi-stage infection process to target organizations...

MS Teams Outlook Add-in missing

MS Teams is installed on the Master Image MS Teams Outlook Add-in is visible on the Master Image session MS Teams Outlook Add-in is missing on the MCS/PVS VDAs...

Russian Midnight Blizzard Hackers Hit MS Teams in Precision Attack

By Waqas The group of Russian hackers involved in this attack is Midnight Blizzard aka NOBELIUM. This is a post from HackRead.com Read the original post: Russian Midnight Blizzard Hackers Hit MS Teams in Precision Attack...

Leaktopus - Keep Your Source Code Under Control

Keep your source code under control. Key Features Plug &Play - one line installation with Docker. Scan various sources containing a set of keywords, e.g. ORGANIZATION-NAME.com. Currently supports: GitHub Repositories Gists coming soon Paste sites e.g., PasteBin coming soon Filter results with a...

Micorosft Down – Xbox, Azure, MS365 and MS Teams Down

By Waqas The service outage began on Wednesday, January 25th, 2023, at around 8:30 AM, Greenwich Mean Time GMT. This is a post from HackRead.com Read the original post: Micorosft Down - Xbox, Azure, MS365 and MS Teams Down...

Microsoft bars Tutanota users from registering MS Teams accounts

By Waqas According to a Microsoft spokesperson, it will not be possible to change the current situation with Tutanota. Tutanota… This is a post from HackRead.com Read the original post: Microsoft bars Tutanota users from registering MS Teams accounts...

Citrix Workspace App for Mac - Webcam redirection via MS Teams (i.e. Both 32-Bit and 64-Bit)

Workspace app for MAC introduced support for HDX Webcam redirection for 64-bit apps, and hence support Teams. Older versionsdo not support MS Teams for Webcam redirection. We are currently working onTeams Optimization Packcontact your Account Manager to get access to EAR - this technology would...

WhatTheHack - A Collection Of Challenge Based Hack-A-Thons Including Student Guide, Proctor Guide, Lecture Presentations, Sample/Instructional Code And Templates

WhatTheHack is a collection of challenge based hack-a-thons including student guide, proctor guide, lecture presentations, sample/instructional code and templates. What, Why and How "What the Hack" is a challenge based hackathon format Challenges describe high-level tasks and goals to be...