CVE-2026-102616

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616

A SQL injection vulnerability exists in risesoft-y9 WorkFlow-Engine up to version 9.6.10 . The flaw is located within the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file in the OAuth2 Resource Filter component. By manipulating the year/processInstanceId arguments, an att...

PT-2026-102813

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

SUSE CVE-2026-66071

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom to convert to a tag atom. The token signature is...

SUSE CVE-2026-67242

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isintegerExp guard skips token-expiry checks for float exp. validatetokenexpiry/1 lines 208-214 and expirytimestamp/1 138-144 both guard with 'when isintegerExp' and fall through to ok/never for float values...

SUSE CVE-2026-67409

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

SUSE CVE-2026-67410

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha

Nezha: OAuth2 redirecturi Host header injection regression when dashboardhost is empty in github.com/nezhahq/nezha...

curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

A flaw was found in curl. When an OAuth2 bearer token is used for an HTTPS transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the .netrc file, allowing the bearer token intended for the first host to be sent to the...

CVE-2026-101090

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

EUVD-2026-88025

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090

Nezha version 2.2.3 is vulnerable to a Host header injection regression in the OAuth2 redirect endpoint located at /api/v1/oauth2/{provider} (specifically in cmd/dashboard/controller/oauth2.go). When the optional dashboard_host setting is empty, the application reflects an attacker-supplied HTTP ...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101090

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101059

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

EUVD-2026-87984

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101059 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...