288 matches found
EasyTokens
EasyTokens Сервер фишинга с использованием кода устройства для имитации действий злоумышленника. Захватывает токены OAuth Microsoft 365 через поток Device Authorization Grant. Вдохновлен GraphSpy. Предупреждение — только для авторизованного использования. Этот инструмент предназначен для...
trust-boundary-ctf
🐘 Trust Boundary: MCP 세션 격리 CTF 콘솔에는 세션 활성 이라고 표시됩니다. 모든 도구 호출은 성공합니다. 관리자 OAuth 토큰은 모든 응답에 포함되어 있습니다. Trust Boundary 는 로컬에서 실행 중인 MCP 서버에서 발생한 실제 세션 격리 실패를 기반으로 구축된 브라우저 기반 CTF 랩입니다. 이 취약점은 시뮬레이션이 아니라 실행 중인 프로세스에서 실제로 동작합니다. 플래그는 세 개입니다. DevTools만 사용하면 됩니다. 공격 하나의 공유된 가변 컨텍스트 객체. 시작 시 관리자 자격 증명이...
CVE-2026-87031
Concrete CMS versions 9.2.0 through 9.5.3 contain a missing authorization check in the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php). Because no permission check was performed before account creation, any valid OAuth token car...
cs50-cyber-paloalto-oauth
CS50 사이버보안 기말 프로젝트 제목: Salesloft OAuth 침해 사고 및 CVE-2024-3400 Palo Alto 영향 저자: Yafiya Darwesh GitHub: Yafiah-Darwesh YouTube 동영상: https://youtu.be/CxQNj9qWoZ0?si=cHCwuTIY26YHJ8aw CVE: CVE-2024-3400 파일 presentation.pdf — 슬라이드 script.txt — 발표자 노트 요약 간단히: 잘못 구성된 OAuth 토큰 검증으로 인해 토큰 위조 및 OAuth 통합 전반에 ...
CVE-2026-18115
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...
CVE-2026-18115
Concrete CMS versions 9.2.0 through 9.5.2 fail to enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). An authenticated user holding an update-scoped OAuth token and permission to ...
EUVD-2026-78913
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...
CVE-2026-18115 In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...
CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration
Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...
EUVD-2026-78210
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...
CVE-2026-91201
DocsGPT through 0.20.0 is affected by an OAuth token disclosure via a wildcard postMessage in the callback-status endpoint. Session tokens are posted without validating the sender origin, allowing an attacker acting as window.opener during the OAuth authorization flow to steal session tokens and ...
CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...
CVE-2026-54447
garminconnect (versions ≤ 0.3.4) is a Python 3 API wrapper for Garmin Connect that stores OAuth tokens in ~/.garminconnect/garmin_tokens.json. The Client.dump() method created the token directory and file without specifying restrictive file modes, so under a permissive umask (e.g., 022) the token...
CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...
CVE-2026-55837
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...
CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...
Astra Linux – Vulnerability in curl
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3, or SMTP scheme, curl may incorrectly pass the bearer token to the new target host...
Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following...