5358 matches found
UBUNTU-CVE-2026-22797
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...
CVE-2026-21618
Summary: CVE-2026-21618 is an XSS vulnerability in hexpm (hexpm/hexpm) affecting Elixir HexpmWeb.SharedAuthorizationView. The issue stems from improper input neutralization in web page generation, specifically in lib/hexpm_web/views/shared_authorization_view.ex and the function render_grouped_sco...
CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in hexpm hexpm/hexpm 'Elixir.HexpmWeb.SharedAuthorizationView' modules allows Cross-Site Scripting XSS. This vulnerability is associated with program files...
EUVD-2026-3202
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...
CVE-2025-14524
When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...
SUSE CVE-2017-18897
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...
Malicious Package
Overview oe-oauth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
MiracleLinux 7 : mod_auth_openidc-1.8.8-5.el7 (AXSA:2019-4244:01)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4244:01 advisory. modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an AuthType oauth20 configuration CVE-2017-6413 modauthopenidc: Shows user-supplied...
CVE-2026-23477
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long a...
CVE-2026-23477 Rocket.Chat Unauthorized Access to OAuth App Details
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long a...
EUVD-2026-2667
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long a...
PT-2026-2940
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long a...
OAuth Parameter Injection
Auth0 Next.js is vulnerable to OAuth Parameter Injection. The vulnerability is due to insufficient validation of the returnTo parameter, where attacker-controlled input can inject unintended OAuth query parameters into the authorization request, potentially resulting in tokens being issued with...
n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens
Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers' OAuth credentials. One such package, named "n8n-nodes-hfgjf-irtuinvcm-lasdqewriit," mimics a Google Ads...
Malicious Package
Overview @diendh/n8n-nodes-tiktok-v2 is a malicious package. This package leverages n8n workflow automation disguising as a n8n community node to exfiltrate OAuth tokens, API keys, and sensitive credentials of integrated services. Remediation Avoid using all malicious instances of the...
Malicious Package
Overview n8n-nodes-danev is a malicious package. This package leverages n8n workflow automation disguising as a n8n community node to exfiltrate OAuth tokens, API keys, and sensitive credentials of integrated services. Remediation Avoid using all malicious instances of the n8n-nodes-danev package...
Malicious code in oe-oauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53c7a0c82b0a316878dbbd5767381ca0ef874192a308eb5001b953915dc816b The package oe-oauth was found to contain malicious code. Source: ghsa-malware 412d8ae25ded16fb507e7d120484a172ece322758c56fb4da2a6a7cd79b5be49 Any...
MAL-2026-196 Malicious code in oe-oauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53c7a0c82b0a316878dbbd5767381ca0ef874192a308eb5001b953915dc816b The package oe-oauth was found to contain malicious code. Source: ghsa-malware 412d8ae25ded16fb507e7d120484a172ece322758c56fb4da2a6a7cd79b5be49 Any...
CVE-2021-22001
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider IdP of type “oauth 1.0” was sent to UAA server...