CVE-2026-7887

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

@rebelware/fibonacci-generator (=0.0.3), react-oauth2-auth-code-flow (>=1.0.0 <=1.0.2) potentially affected by unknown CVE via react-oauth-flow (=1.2.0)

react-oauth-flow NPM version =1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-oauth-flow and may be impacted: - @rebelware/fibonacci-generator =0.0.3 - react-oauth2-auth-code-flow =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory:...