261 matches found
CVE-2025-12028
1 Start a simple HTTP server to host the proof-of-concept page mkdir -p /tmp/attacker && cd /tmp/attacker php -S 127.0.0.1:8000 2 Create a file /tmp/attacker/poc.html with the following contents document.getElementById'x'.submit; 3 Trigger the PoC in a logged-in browser session While logged into:...
CVE-2026-97274
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
CVE-2026-97274
The WordPress OAuth Single Sign On – SSO (OAuth Client) plugin, versions
EUVD-2026-89923
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
CVE-2026-97274 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...
EUVD-2026-88754
OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...
oauth-client-exploit
This repository does not have a README...
PT-2026-96925
Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description OAuthConfig writes a plaintext fallback file containing access token and refresh token within the user's .mcp-atlassian directory. This file is created using process-default permissions rather...
CVE-2026-49254
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...
CVE-2026-49254 Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc or RBAC, while manager/handlers/oauth.go returns models.Oauth records and...
CVE-2026-12985: URL Redirection to Untrusted Site
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirecturis, leaving clientname and granttypes bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...
CVE-2026-86754
Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...
CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...
CVE-2026-78627
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
EUVD-2026-74176
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
CVE-2026-78627
Okta Hyperdrive Integration installer exposes the OAuth client secret in plaintext when it is passed as an MSI property. The credential is recorded in three locations readable by an authenticated local user: the installer log , the Application Event Log , and the process command line . The CVSS 3...
CVE-2026-78627 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
CVE-2026-78627 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...