janusec

Janusec Application Gateway / Gateway Applicativo JANUSEC Readme in Inglese Fornire una consegna rapida e sicura delle applicazioni Slide di presentazione: https://www.janusec.com/download/Janusec-Application-Gateway-CN.pdf Funzioni principali Le funzioni principali del JANUSEC Application Gatewa...

PT-2026-82217

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0 Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP...

CVE-2026-79652

A flaw in the JWT Bearer authorization grant within the keycloak-services component of Red Hat Build of Keycloak fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion...

CVE-2026-79652

A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

CVE-2026-3456-OAuth2-PKCE-Race-Condition-Account-Takeover-

8. CVE-2026-3456 – Condição de Corrida no PKCE OAuth2 Assunção de Conta Visão Geral Uma condição de corrida no servidor de autorização OAuth2 permite que um atacante reutilize o código de autorização da vítima antes que o cliente legítimo o resgate, adivinhando ou forçando por brute-force o...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — Acquisizione account OAuth2/OIDC AshAuthentication Proof of Concept per CVE-2026-49757 — una vulnerabilità critica in AshAuthentication in cui i callback OAuth2/OIDC risolvevano gli account utente locali tramite indirizzo email invece della coppia identità strategy, sub,...

pocketbase-CVE-2026-44166

CVE-2026-44166: Pre-Sequestro dell'Account OAuth2 di PocketBase Una raccolta di autenticazione di PocketBase con OAuth2 abilitato permette al client di passare un oggetto createData quando si registra. L'email all'interno di createData non viene mai confrontata con l'email verificata dal provider...

CVE-2026-76835

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

EUVD-2026-65061

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835

OAuth2 Proxy versions 7.15.2 through 7.15.4 are affected by an authentication bypass via the X-Forwarded-Uri header. When reverse-proxy mode is enabled without trusted_proxy_ip configured, buildTrustedProxyNetSet falls back to 0.0.0.0/0 and ::/0, treating every client as a trusted proxy. An unaut...

CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

CVE-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

gitea-CVE-2026-28699

CVE-2026-28699: Bypass dello Scope OAuth2 di Gitea tramite HTTP Basic Auth Un token di accesso OAuth2 di Gitea con scope limitato a solo read:user può eseguire azioni di scrittura complete quando viene inviato come Authorization: Basic base64:x-oauth-basic invece che come token Bearer. Il control...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

kanidm

Kanidm - Einfaches und sicheres Identitätsmanagement Über Kanidm ist eine einfache und sichere Plattform für das Identitätsmanagement, die es anderen Anwendungen und Diensten ermöglicht, die Herausforderung der Authentifizierung und Speicherung von Identitäten an Kanidm auszulagern. Das Ziel dies...

oauth2-proxy

OAuth2 Proxy è uno strumento open-source flessibile che può fungere da reverse proxy autonomo o da middleware integrato in configurazioni di reverse proxy o load balancer esistenti. Fornisce un modo semplice e sicuro per proteggere le tue applicazioni web con l'autenticazione OAuth2 / OIDC. Come...

oauth-scan

OAUTHScan Descrizione OAUTHScan è un'estensione per Burp Suite scritta in Java con lo scopo di fornire alcuni controlli di sicurezza automatici, che potrebbero essere utili durante i test di penetrazione su applicazioni che implementano gli standard OAUTHv2 e OpenID. Il plugin cerca varie...

authentik

Cos'è authentik? authentik è un Identity Provider IdP open-source per il moderno SSO. Supporta SAML, OAuth2/OIDC, LDAP, RADIUS e altro, progettato per l'auto-hosting da piccoli laboratori a grandi cluster di produzione. La nostra offerta enterprise è disponibile per le organizzazioni per sostitui...

CVE-2026-75866

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...