CVE-2026-97288

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288

The WordPress OAuth Server plugin, version 4.5.1 and below , is vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability is attributed to the Contributor role. While the vulnerability is confirmed, specific technical root causes, exploitation details, or remediation steps are not provid...

EUVD-2026-89929

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...

CVE-2026-97288: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

PT-2026-103261

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...

CVE-2026-82843

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-82843

The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.4.0 , is vulnerable to a cross-user account takeover due to an improper authentication flaw. The plugin fails to bind the issued OpenID Connect identity assertion to the specific authorization grant being exchanged....

EUVD-2026-85030

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

CVE-2026-82843: Improper Authentication

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

PT-2026-97166

Name of the Vulnerable Software and Affected Versions WP OAuth Server Login with WordPress versions prior to 6.4.0 Description The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently...

PT-2026-93788

Name of the Vulnerable Software and Affected Versions rmcp versions prior to 2.0.0 Description The OAuth implementation in the rmcp crate fails to validate the resource parameter in OAuth Protected Resource metadata as required by RFC 9728. Specifically, the ResourceServerMetadata struct omits th...

EUVD-2026-76187

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and...

CVE-2026-86075

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

CVE-2026-49329

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...