CVE-2026-3583

Multiple WSO2 products are affected by a vulnerability where the OAuth2 token introspection mechanism fails to immediately invalidate a token in the cache following a revocation request when the allowed_scopes configuration is enabled. This insufficient session expiration (CWE-613) allows a revok...

EUVD-2026-112400

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

CVE-2026-3583 Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

When the allowedscopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned...

PT-2026-129162

When the allowed scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returne...

PT-2026-130600

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration t...

PT-2026-130583

The module enables authentication via the OpenID Connect oAuth2 protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account except user 1 that has not yet be...

Authorization Bypass Through User-Controlled Key

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the createconfigurationresponse method in authlib/oauth2/rfc7592/endpoint.py, where a registration access token issu...

CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...

Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...

ROOT-APP-GOBINARY-CVE-2025-22868 CVE-2025-22868 in golang.org/x/oauth2 - Patched by Root

Root has patched CVE-2025-22868 in the golang.org/x/oauth2 package for Root:Go. Multiple fixed versions available...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: oauth2-proxy: oauth2-proxy-7.15.5-0.3.hum1 aarch64, s390x, x8664 oauth2-proxy-7.15.5-0.3.hum1.src src Security Fixes: oauth2-proxy: CVE-2026-111943...

Exploit for CVE-2026-85317

CVE-2026-85317 — camel-http: OAuth2 token cache confusion Run...

CLSA-2026-1792570553 dovecot: Fix of 7 CVEs

CVE-2026-27852: bound the transient RFC 2231 parameter list and the MIME parameter budget so a single oversized Content-Type header cannot exhaust imap memory - CVE-2026-33263: track SMTP server connection closure so submission-login does not keep using a closed connection - CVE-2026-33605: fix...

Apache Camel 4.22.0 OAuth2 Token Cache Confusion

Apache Camel camel-http versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain an OAuth2 token-cache flaw that can reuse a token across endpoints differing by scope, resource indicator, or token endpoint. The supplied proof of concept demonstrates the behavior...

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused...

CVE-2026-67410

A flaw was found in rabbitmq-server. When OAuth2 authentication is enabled for the management interface, the server inadvertently exposes the configured client secret within an unauthenticated JavaScript file. A remote, unauthenticated attacker with access to the management interface can retrieve...

Exploit for CVE-2026-85251

CVE-2026-85251 — camel-http: credential disclosure on redirect...

Use of Cache Containing Sensitive Information

Overview org.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the OAuth2 token cache in the camel-http component. The...

CVE-2026-110008

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-110008

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

@appweaver/core (>=1.0.0, <=1.12.2), @fzkit/oauth2-apple (>=0.0.1, <=0.1.0) +2 more potentially affected by CVE-2026-110008 via @fastify/oauth2 (>=8.1.2, <=8.3.0)

@fastify/oauth2 NPM version =8.1.2, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.1.0 Source cves: CVE-2026-110008 Source advisory: MEND:CVE-2026-110008...