grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-16262

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

EUVD-2026-54232

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-53573

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

EUVD-2026-50563

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion Unbounded Map Growth...

CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

Improper Verification of Cryptographic Signature

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verifysignature parameter in the Azure AD OAuth login defaulting to False,...

PT-2026-65767

The FAB auth manager's Azure AD OAuth login defaulted verify signature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-8609

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

Linux Distros Unpatched Vulnerability : CVE-2026-8609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memo...

SUSE CVE-2026-8609

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance denial of service...

CVE-2026-8609

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance denial of service...

PT-2026-57277

Name of the Vulnerable Software and Affected Versions miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn versions prior to 7.7.1 Description An authentication bypass exists in the Profile Completion flow that allows for account takeover. The issue occurs because the plugin...