Input validation

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker...

Design/Logic Flaw

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228

CVE-2023-48228 affects the authentik open-source IDP. The vulnerability is in the PKCE code_verifier validation during OAuth2 token exchange: prior to versions 2023.10.4 and 2023.8.5, authentik accepted a token request without verifying the code_verifier even when a code_challenge was used. The i...

CVE-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

Subdomain Validation Bypass - ownCloud

Within the oauth2 app an attacker is able to pass in a specially crafted redirect-url which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker...

CVE-2023-49104

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker...

CVE-2023-49104

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker...

CVE-2023-49104

CVE-2023-49104 affects ownCloud’s OAuth2 component (versions before 0.6.1) where enabling “Allow Subdomains” lets an attacker craft a redirect-url that bypasses validation, enabling callbacks to a top‑level domain controlled by the attacker. Documents consistently state the impact as redirection ...

ownCloud Security Breach

ownCloud is a personal cloud storage solution from the U.S.-based ownCloud, Inc. A security vulnerability exists in ownCloud oauth2 versions prior to 0.6.1, which stems from the ability to pass in a specially crafted redirect URL in the oauth2 application that bypasses authentication code and can...

Malicious code in discord-oauth2.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c230934619742d3d57fbc719cc2eff0dabd57a22c74405adcdf1e214fee0b91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8493 Malicious code in discord-oauth2.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c230934619742d3d57fbc719cc2eff0dabd57a22c74405adcdf1e214fee0b91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 (CVE-2022-22576)

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: k3d, dgraph, src, aactl, prometheus-blackbox-exporter, spark-operator, cortex, scorecard, terraform-provider-sendgrid, kubeflow, slsa-verifier, kubescape, kubevela, buildkitd, up...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: bank-vaults-fips, kubeflow, kubevela, metrics-server-fips, kubeflow-fips, kubernetes-csi-livenessprobe-fips, up, spark-operator, conftest-fips, aactl, dynamic-localpv-provisioner-fips, buildkitd, dgraph, cortex, timestamp-authority-fips, aws-efs-csi-driver-fips,...

GHSA-MX47-H5FV-GHWH light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

Design/Logic Flaw

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

light-oauth2 Trust Management Issue Vulnerability

light-oauth2 is networknt open source a light-4j based fast , lightweight cloud-native OAuth 2.0 authorization microservice . light-oauth2 version 2.1.27 before the existence of a security vulnerability , the vulnerability stems from obtaining the public key without any validation , allowing an...