312 matches found
FlowAnalyzer
Flow Analyzer Flow Analyzer ist dafür ausgelegt, ein Verständnis auf niedriger Ebene und das Testen von OAuth-2.0-Grants/Flows zu unterstützen. Obwohl meine Anwendungsfälle aus dem Sicherheitsbereich stammen, kann es auch aus der Sicht eines Engineers nützlich sein 😊 Du findest die Notebooks zur...
CVE-2026-51954
Produkt: Webasyst Framework Betroffene Version: ≤ 4.0.3 Schweregrad: Hoch CVSS 3.1: 8.0 Beschreibung Das Webasyst Framework bis einschließlich 4.0.3 enthält einen Implementierungsfehler in OAuth 2.0, der es einem entfernten, nicht authentifizierten Angreifer ermöglicht, Autorisierungsdaten...
Threat_Model_Examples
Esempi di Modelli di Minaccia Questo repository contiene vari esempi di modelli di minaccia per diverse tecnologie e sistemi. Queste risorse forniscono esempi illustrativi di modelli di minaccia in diversi ambiti, aiutando i professionisti della sicurezza, gli sviluppatori e i ricercatori a...
OpenAM
Open Access Management OpenAM è una soluzione di gestione degli accessi che include autenticazione, SSO, autorizzazione, federazione, entitlement e Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 e OpenID Connect garantiscono che OpenAM si integri facilmente con...
CVE-2026-22005-OAuth-2.0-Device-Code-Phishing-Short-Interval-
CVE-2026-22005 – Phishing del Codice Dispositivo OAuth 2.0 Intervallo Breve Codice Programma Python root@kitploit: devicecodeserver.py - Authorization server with too-fast polling import time, secrets codes = @app.route'/device/code' def devicecode: code = secrets.tokenurlsafe16 codescode =...
kit-oauth
kit-oauth Libreria client OAuth 2.0 per applicazioni Kit TOC File File| Descrizione ---|--- .editorconfig| Configurazione di formattazione dell'editor .gitignore| Regole Git ignore per artefatti di build e dipendenze .tool-versions| Versioni degli strumenti asdf Zig, Kit LICENSE| File di licenza...
hydra
Chat · Discussioni · Newsletter · Documentazione · Prova Ory Network · Lavora con noi Ory Hydra è un server OAuth 2.0 OpenID Certified, robusto e sicuro, e un provider OpenID Connect, ottimizzato per bassa latenza, elevate prestazioni e basso consumo di risorse. Si collega al tuo identity provide...
EUVD-2026-59767
@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...
PT-2026-73032
@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...
CVE-2026-41479
A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit the OAuth 2.0 authorization endpoint by providing an unsupported response type and a malicious redirect Uniform Resource Identifier URI. This allows the attacker to redirect...
CVE-2026-16336
Technical details about CVE-2026-16336 are not publicly available in the provided documents. Monitor for updates from trinodb/trino project and CVE listings.
EUVD-2026-42979
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refre...
CVE-2026-41479
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...
CVE-2026-41479 Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...
CVE-2026-7887 For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...
@node-oauth/oauth2-server 安全漏洞
@node-oauth/oauth2-server is an open-source Node.js OAuth2 server implementation that adheres to RFC standards. @node-oauth/oauth2-server has a security vulnerability; this vulnerability stems from the token exchange path accepting an invalid codeverifier value according to RFC7636, which may lea...
CVE-2026-3783
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with eithe...
CVE-2026-25649 Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The redirecturi parameter is not validated against a...
