CVE-2026-11102-OAuth2-Implicit-Grant-Fragment-Hijacking

CVE-2026-11102 – OAuth2 Implicit Grant Fragment Hijacking Program Code Node.js + Exploit // oauthserver.js - OAuth2 provider issuing tokens in fragment const express = require'express'; const app = express; app.get'/authorize', req, res = const redirectUri = req.query.redirecturi; const state =...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeover Proof of Concept for CVE-2026-49757 — a critical vulnerability in AshAuthentication where OAuth2/OIDC callbacks resolved to local user accounts by email address instead of the strategy, sub identity pair, allowing unauthenticated...

CVE-2024-9014

CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources. Tools 1...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – OAuth2 PKCE Race Condition Account Takeover Overview A race condition in the OAuth2 authorization server allows an attacker to reuse a victim’s authorization code before the legitimate client redeems it, by guessing or brute‑forcing the PKCE codeverifier within a small time...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

CVE-2026-118573

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

CVE-2026-114542

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth OAuth2 & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth OAuth2 & OpenID Connect versions: from 6.1.0 to 6.1.3...

gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth A Gitea OAuth2 access token scoped to only read:user can perform full write actions when it is sent as Authorization: Basic base64:x-oauth-basic instead of as a Bearer token. The scope check is skipped for any token presented over Basi...

CVE-2026-114542

The Drupal Simple OAuth (OAuth2) & OpenID Connect module (versions 6.1.0 to 6.1.3 ) is vulnerable to an access bypass due to a Use of Web Browser Cache Containing Sensitive Information (CWE-525). The module incorrectly caches token permissions, allowing them to be reused for other user tokens wit...

EUVD-2026-113530

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth OAuth2 & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth OAuth2 & OpenID Connect versions: from 6.1.0 to 6.1.3...

CVE-2026-118554

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

EUVD-2026-113684

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

CVE-2026-118573

The Drupal OAuth2 Token Manager module (versions 0.0.0 to 1.2.0 ) is vulnerable to a Missing Authorization (CWE-862) issue. The module fails to restrict access to its OAuth2 routes , which could allow an anonymous visitor to connect the site's integration to an account they control. However, the ...

CVE-2026-118573

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 Account Pre-Hijacking A PocketBase auth collection with OAuth2 enabled lets the client pass a createData object when it signs up. The email inside createData is never checked against the email the OAuth2 provider verified. Anyone with an account on a configured...

oauth-scan

OAUTHScan Description OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards. The plugin looks for various OAUTHv2/OpenID vulnerabilities...

CVE-2026-85317

CVE-2026-85317 — camel-http: OAuth2 token cache confusion Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-http's OAuth2 client token cache — a JVM-globalstatic map — keyed its entries on only uri, clientId, clientSecret, omitting the fields that actually shape...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

CVE-2026-3583

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...