CVE-2026-59358

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358

Cloud Foundry UAA (v3.7.0 to v79.6.0) and CF Deployment (up to v60.4.0) are vulnerable to an Improper Authentication (CWE-287) flaw in the OAuth token endpoint. The system fails to verify if a Bearer credential is a legitimate client secret, instead accepting any valid access token where the clie...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

EUVD-2026-92988

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

PT-2026-106360

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper authentication in the OAuth token endpoint allows a remote, authenticated attacker with a valid user access token to obtain a fully-privileged client credentials token for...

CVE-2026-59358: Improper Authentication

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

CVE-2026-86073: Incorrect Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

PT-2026-81025

Name of the Vulnerable Software and Affected Versions hexpm versions 2025-10-18 through 2026-08-23 Description An incorrect authorization issue exists in the OAuth token endpoint. An API key with the repositories permission can be used to read private packages belonging to another organization...

CVE-2026-75542: Incorrect Authorization

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-18382 Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...

CVE-2026-45689 Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with...

CVE-2026-45689

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with...