Robinhood: Open Redirect located at https://www.robinhood.com/oauth2/authorize/?

Robinhood's OAuth2 authorization endpoint allowed arbitrary redirect URIs to be specified. While the actual OAuth2 code was not sent to the third party URI, the user was still redirected to the URI resulting in an open redirect vulnerability. This has since been fixed to show the proper error...

Uber: Open Redirect on central.uber.com allows for account takeover

An error in our OAuth2 flow for central.uber.com allowed an attacker to leverage an open redirect that allowed for a full account takeover. When logging into central.uber.com, the state parameter for login.uber.com contained a redirect location instead of a CSRF token. As a result, an attacker...

Unauthorised Modification Of Permission Scope

spring-security-oauth2 is vulnerable to unauthorised modification of scope. A malicious user can submit a scope parameter during token request, which will be accepted by the server. This allows the malicious user to gain a wider scope of permissions when they authenticate...

OAuth2 Client- Moderately Critical - Cross Site Request Forgery - SA-CONTRIB-2016-044

This module provides an OAuth2 client. The module does not check the validity of the state parameter, during server-side flow, before getting a token. This may allow a malicious user to feed a fake accesstoken to another user, and subsequently provide him fake data from the server. This page...

Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)

Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...

Coinbase: XXE in OAuth2 Applications gallery profile App logo

upload svg photo XML based as App logo contain XML payload renamed to .jpg server start execute this XML payload or just watch this video "https://www.dropbox.com/s/wkba6f0wrax0wr8/xxe.mp4?dl=0" the same vulnerability was in https://www.coinbase.com/careers and reported by...

Spring Social Java Library Social Authentication Vulnerability

A nasty cross-site request forgery vulnerability was patched Thursday in the Spring Social core library, one of the most pervasive Java application libraries. Spring Social facilitates social authentication between applications and online services, and the vulnerability allowed attackers to bypas...

Amazon Linux: Security Advisory (ALAS-2014-425)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : Red Hat Satellite 6.1.1 on RHEL 7 (Important) (RHSA-2015:1591)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1591 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring...

RHEL 6 : Red Hat Satellite 6.1.1 on RHEL 6 (Important) (RHSA-2015:1592)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1592 advisory. Red Hat Product Security has rated this update as having an important security impact. Common Vulnerability Scoring System CVSS base scores,...

Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 6

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having an important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE...

python-oauth2: Uses poor PRNG in nonce

It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...

Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 7

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 7. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning...

python-oauth2: _check_signature() ignores the nonce value when validating signed urls

It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...

zf-oauth2 security bypass vulnerability

OAuth is an open web standard for authorization that is widely used around the world and is currently in version 2.0. A security bypass vulnerability exists in zf-oauth2, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations...

Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass

OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...

WordPress plugin Google Analytics by Yoast stored XSS vulnerability-vulnerability warning-the black bar safety net

WordPress famous plugin Google Analytics by Yoast plug-in exposed storage-typeXSSvulnerability that can allow unauthorized attackers in the WordPress admin panel to store any HTML code, including JavaScript. The administrator to view the plugin Settings panel is a JavaScript will be triggered, do...

QIWI: [qiwi.com] /oauth/confirm.action XSS

Hey hi, I have found a XSS in oauth2 vulnerable link: https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe steps to reproduce: 1 open the following link https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe 2 click...

Fedora 21 : python-oauth2-1.5.211-8.fc21 (2014-12483)

Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...

[SECURITY] Fedora 21 Update: python-oauth2-1.5.211-8.fc21

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...