68 matches found
PT-2026-86927
Server-Side Request Forgery SSRF vulnerability in ash-project ash authentication oauth2 server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces th...
PT-2026-86924
Improper Protection of Alternate Path vulnerability in ash-project ash authentication oauth2 server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2 server protocol routes/1 in...
PT-2026-86928
Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...
PT-2026-86925
Use of Cache Containing Sensitive Information vulnerability in ash-project ash authentication oauth2 server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
PT-2026-86926
Improper Encoding or Escaping of Output vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource metadata=".....
CVE-2026-75866
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...
CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...
EUVD-2026-64293
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...
CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...
CVE-2026-75866
The Punk::OAuth2::Server Perl module (versions through 0.03 ) contains a vulnerability where it issues access tokens outside a client's registered scopes and grant types. The root cause is that the authorization path fails to validate the requested scope against the client's registration. Specifi...
CVE-2026-75866: Missing Authorization
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...
PT-2026-79570
Name of the Vulnerable Software and Affected Versions Punk::OAuth2::Server versions prior to 0.04 Description The software issues access tokens that exceed a client's registered scopes and grant types because the authorization path fails to validate them. Specifically, the token function dispatch...
CVE-2026-50629
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgra...
CVE-2026-41213: Improper Restriction of Excessive Authentication Attempts
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid codeverifier values including one-character strings for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the...
@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)
@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: OSV:GHSA-JHM7-29PJ-4XVF...
@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)
@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: SNYK:JS-NODEOAUTHOAUTH2SERVER-16420261...
CVE-2026-41213
creationtimestamp| type| source ---|---|--- 2026-04-15 08:02:45+00:00| published-proof-of-concept| https://github.com/node-oauth/node-oauth2-server/security/advisories/GHSA-jhm7-29pj-4xvf...
CVE-2026-39976
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value ...
CVE-2017-18924
oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...