CVE-2026-54047: Improper Authentication

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

GHSA-44P5-3M5G-VFHJ SAP Approuter has an Open Redirect vulnerability

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

EUVD-2025-19060

Malicious code in bioql PyPI...

Session Fixation

Moodle is vulnerable to Session Fixation. The vulnerability is due to improper session management and unauthenticated access to the sesskey parameter, which can be reused in the OAuth2 login flow, allowing attackers to hijack user sessions...

CVE-2025-53021

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...

CVE-2025-53021

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the...