185 matches found
CVE-2026-107433
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...
CVE-2026-107433 WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...
CVE-2026-107433
The WP OAuth Server plugin by miniOrange (versions up to and including 6.4.0 ) is vulnerable to a Broken Access Control issue (CWE-862). The root cause is Missing Authorization , which allows for the exploitation of Incorrectly Configured Access Control Security Levels . This vulnerability has a ...
EUVD-2026-101008
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...
CVE-2026-107433: Missing Authorization
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0...
WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nguyen Viet Tin in WordPress Plugin WP OAuth Server versions = 6.4.0...
CVE-2026-108718
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...
CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...
CVE-2026-108718
The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...
CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...
EUVD-2026-96992
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...
CVE-2026-108718: Missing Authorization
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...
PT-2026-110121
Name of the Vulnerable Software and Affected Versions Rill versions 0.77.0 through 0.90.5 Description The admin OAuth server fails to properly authorize requests, allowing the issuance of authorization codes to dynamically registered clients without requiring user consent. An attacker can registe...
CVE-2026-97288
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
EUVD-2026-89929
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-97288 WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...
CVE-2026-97288
The WordPress OAuth Server plugin, version 4.5.1 and below , is vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability is attributed to the Contributor role. While the vulnerability is confirmed, specific technical root causes, exploitation details, or remediation steps are not provid...
WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...