CVE-2026-73419

NextAuth.js/NMD vulnerability CVE-2026-73419 affects Auth.js OAuth/OIDC flow cookies. Prior to Auth.js @auth/core 0.41.3 and NextAuth.js 4.24.15 or 5.0.0-beta.32, state, nonce, and PKCE verifier were stored in global cookies not bound to the originating provider. On callback, a value from one pro...

CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

HackerOne: Changing Victim's JIRA Integration Settings Through Multiple Bugs

Summary: Changing victim's JIRA integration settings through multiple bugs. Description: Using multiple HackerOne bugs, an attacker can change the victim's JIRA integration settings. Bugs: 1 The Jira integration consent screen lacks information about the Jira project that will be connected to...