kratos

Chat · Discusiones · Boletín informativo · Documentación · Probar Ory Network · Empleos Ory Kratos es un sistema de gestión de identidad y usuarios API-first para aplicaciones nativas de la nube. Centraliza los flujos de inicio de sesión, registro, recuperación, verificación y gestión de perfiles...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeover Proof of Concept for CVE-2026-49757 — a critical vulnerability in AshAuthentication where OAuth2/OIDC callbacks resolved to local user accounts by email address instead of the strategy, sub identity pair, allowing unauthenticated...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

RabbitMQ Management - OAuth 2 Client Secret Disclosure

RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauthclientsecret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management...

kanidm

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

CVE-2026-73312

CVE-2026-73312 XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the replacement token family, then asks the parent...

CVE-2024-9014

CVE-2024-9014 - Herramientas de explotación de omisión de autenticación OAuth2 de pgAdmin 4 Este repositorio contiene herramientas para comprobar y explotar la vulnerabilidad CVE-2024-9014 en pgAdmin 4. La vulnerabilidad permite a un atacante omitir la autenticación OAuth2 y acceder a recursos...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - toma de control de cuenta mediante CSRF en autenticación de GitHub PoC CVE-2022-24342 Requisitos Uso ¿Cómo funciona? GitHub OAuth2: orden de procesamiento de parámetros de consulta CVE-2022-24342: flujo de solicitudes HTTP Requisitos JetBrains TeamCity...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

janusec

Janusec Application Gateway / Puerta de enlace de aplicaciones JANUSEC README en inglés Entrega de aplicaciones rápida y segura PPT de introducción: https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf Funciones principales Las funciones principales de JANUSEC Application Gateway...

SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE

Este proyecto proporciona soporte para usar Spring Security con OAuth 1a y OAuth2. Ofrece funcionalidades para implementar tanto consumidores como proveedores de estos protocolos utilizando los modelos de programación e idiomas de configuración estándar de Spring y Spring Security. Código de...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

authentik

什么是 authentik？ authentik 是一个面向现代单点登录（SSO）的开源身份提供者（IdP）。它支持 SAML、OAuth2/OIDC、LDAP、RADIUS 等协议，专为自托管而设计，从小型实验室到大型生产集群均适用。 我们的企业版产品可供组织使用，以安全地替代 Okta、Auth0、Entra ID 和 Ping Identity 等现有 IdP，实现稳健的大规模身份管理。 安装 Docker Compose：推荐用于小型/测试环境。请参阅文档。 Kubernetes（Helm Chart）：推荐用于较大型环境。请参阅文档和 Helm chart 的仓库。 AWS...

CVE-2024-9014

Esta publicación es un artículo de investigación publicado por EQSTLab. CVE-2024-9014 ★ PoC de Exposición de Información Sensible CVE-2024-9014 ★ Descripción CVE-2024-9014 : Exposición de Información Sensible en pgAdmin4 descripción: las versiones 8.11 y anteriores de pgAdmin son vulnerables a un...

CVE-2026-29198-POC

CVE-2026-29198-POC Rocket.Chat OAuth2 Inyección NoSQL , en Rocket.Chat 8.3.0, 8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6 y 7.10.9 instalación: pip3 install -r requirement.txt Exploit: python3 poccve202629198.py --url domain --escalate -v...

oauth2-proxy

OAuth2 Proxy 是一款灵活的开源工具，既可以作为独立的反向代理使用，也可以作为中间件组件集成到现有的反向代理或负载均衡器设置中。它提供了一种简单且安全的方式，通过 OAuth2 / OIDC 身份验证来保护您的 Web 应用程序。作为反向代理，它拦截对您应用程序的请求，并将用户重定向到 OAuth2 提供商进行身份验证。作为中间件，它可以无缝集成到您现有的基础设施中，为多个应用程序处理身份验证。 OAuth2 Proxy 支持大量 OAuth2 以及 OIDC 提供商。既可以通过通用 OIDC 客户端，也可以通过针对 Google、Microsoft Entra...

gitea-CVE-2026-28699

CVE-2026-28699: Omisión de alcance OAuth2 de Gitea a través de autenticación básica HTTP Un token de acceso OAuth2 de Gitea con alcance solo read:user puede realizar acciones de escritura completas cuando se envía como Authorization: Basic base64:x-oauth-basic en lugar de como un token Bearer. La...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...