gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth A Gitea OAuth2 access token scoped to only read:user can perform full write actions when it is sent as Authorization: Basic base64:x-oauth-basic instead of as a Bearer token. The scope check is skipped for any token presented over Basi...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

pocketbase-CVE-2026-44166

CVE-2026-44166: PocketBase OAuth2 Account Pre-Hijacking A PocketBase auth collection with OAuth2 enabled lets the client pass a createData object when it signs up. The email inside createData is never checked against the email the OAuth2 provider verified. Anyone with an account on a configured...

CVE-2022-25262

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...

janusec

Janusec Application Gateway / JANUSEC应用网关 English Readme 提供快速、安全的应用交付 介绍PPT： https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf 主要功能 JANUSEC应用网关的主要功能有： 向Web应用提供统一的安全接入，包括HTTPS、身份认证、安全防御（WAF/CC）等。如Web应用是通过K8S Pods部署的，该网关也可以作为K8S Ingress Controller使用，向Pods提供跟普通Web应用同样的接入和安全特性。...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

kafka-keycloak-oauth

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

RabbitMQ Management - OAuth 2 Client Secret Disclosure

RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauthclientsecret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner A non-intrusive, version-based vulnerability scanner for CVE-2026-4282 , affecting Keycloak and Red Hat Build of Keycloak RHBK. ⚠️ Disclaimer: This tool is intended strictly for authorized security research, penetration testing, and defensive vulnerability management. Only ru...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

CVE-2020-10770-keycloak-exploit-poc

Keycloak Blind SSRF POC This is a step by step walk-through about how to test the Blind SSRF CVE-2020-10770 found by Lauritz Holtmann and documented in his blog post. He also briefly explained how to test it. This is just a more detailed explanation. All credits go to Lauritz. Setup I use Docker ...

CVE-2026-11102-OAuth2-Implicit-Grant-Fragment-Hijacking

CVE-2026-11102 – OAuth2 Implicit Grant Fragment Hijacking Program Code Node.js + Exploit // oauthserver.js - OAuth2 provider issuing tokens in fragment const express = require'express'; const app = express; app.get'/authorize', req, res = const redirectUri = req.query.redirecturi; const state =...