44 matches found
CVE-2025-66040
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting XSS vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's brows...
Cross-site Scripting (XSS)
Overview spotipy is an A light weight Python library for the Spotify Web API Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RequestHandler.doGET function due to the error parameter in the OAuth callback server. An attacker can execute arbitrary JavaScript in...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' during the authentication with OAuth providers that don't support Dynamic Client Registration DCR. An attacker can...
EUVD-2025-34628
When a BIG-IP APM OAuth access profile Resource Server or Resource Client is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
Cursor 操作系统命令注入漏洞
Cursor is an AI code editor from Cursor open source. An operating system command injection vulnerability exists in Cursor 1.7 and earlier versions, which stems from the possibility that specially crafted commands may be returned during the OAuth authentication process, potentially leading to...
The vulnerability of the OAuth and OpenID Connect Single Sign On module in Drupal CMS systems allows attackers to perform cross-site scripting attacks.
The vulnerability of the OAuth and OpenID Connect Single Sign On module in Drupal systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
[SECURITY] Fedora 40 Update: perl-Net-OAuth-0.30-1.fc40
Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...
[SECURITY] Fedora 41 Update: perl-Net-OAuth-0.30-1.fc41
Perl implementation of OAuth, an open protocol to allow secure API authentication in a simple and standard method from desktop and web applications. In practical terms, a mechanism for a Consumer to request protected resources from a Service Provider on behalf of a user...
Red Hat OpenShift 安全特征问题漏洞
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying, and running applications. A security vulnerability exists in Red Hat OpenShift that stems from the OAuth2 protocol being vulnerable to cross-site request forge...
PT-2022-18831 · Jenkins · Jenkins Bitbucket Server Integration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Bitbucket Server Integration Plugin versions 3.1.0 and earlier Description: The issue results from the plugin not limiting URL schemes for callback URLs on OAuth consumers, leading to a stored cross-site scripting XSS vulnerability...
Improper Authorization in react-oauth-flow
All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendation No fix ...
GHSA-65M9-M259-7JQW Improper Authorization in react-oauth-flow
All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendation No fix ...
PT-2020-21081
Name of the Vulnerable Software and Affected Versions react-oauth-flow versions affected versions not specified Description The issue is related to the improper implementation of the OAuth protocol in the react-oauth-flow package. It stores secrets in the front-end code and uses a confidential...
Improper Authorization
Overview All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendatio...
EA Games Patches Account-Hijacking Bug
Researchers chained together two vulnerabilities in the Electronic Arts EA gaming platform and developed a proof-of-concept attack that allowed for possible account takeovers. A successful attack could allow a malicious actor to gain access to a user’s account and steal credit card information or...
Mautic SSO/OAuth2 Plugin Cross-Site Request Forgery Vulnerability
Mautic is an open source marketing automation management software developed and maintained by the Mautic community. The software has features such as monitoring websites, creating web pages and sending emails.Mautic SSO/OAuth2 is one of the single sign-on plug-ins based on the OAuth2 a secure log...
DEBIAN-CVE-2017-6413
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" aka modauthopenidc module before 2.1.6 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP...
Drupal OAuth Module Access Bypass Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OAuth is one of the third-party modules that enables you to authenticate requests using the OAuth 1.a protocol. An access bypass vulnerability exists in the Drupal OAuth module. An...
python-oauth2: Uses poor PRNG in nonce
It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...
