CVE-2026-73310

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can then exchange an int...

EUVD-2026-72781

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an...

EUVD-2026-72780

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which...

CVE-2026-73309

XenForo before 2.3.13 is vulnerable to an authentication bypass in its OAuth2 token endpoint . An unauthenticated attacker can submit empty strings for the client_secret and code_verifier parameters; because PHP truthy evaluation treats empty strings as falsy, both the client secret check and the...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC 계정 탈취 CVE-2026-49757 에 대한 개념 증명 — AshAuthentication의 심각한 취약점으로, OAuth2/OIDC 콜백이 strategy, sub 식별자 쌍 대신 이메일 주소 로 로컬 사용자 계정을 확인하여 인증되지 않은 계정 탈취를 허용합니다. Field| Value ---|--- CVE| CVE-2026-49757 CVSS 4.0| 9.2 심각 CWE| CWE-290 스푸핑을 통한 인증 우회 GHSA|...

onedrive_user_enum

onedriveuserenum v2.10 enumerate valid onedrive users For a full rundown of the enumeration technique and OneDrive enum, check out the blog here: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ If you are looking for the old, non-database vesion of OneDrive Enum, you can find it here:...

CVE-2026-82757

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82753 Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

EUVD-2026-72535

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

EEF-CVE-2026-82753 Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled,...

gitea-CVE-2026-28699

CVE-2026-28699: Обход области OAuth2 в Gitea через HTTP Basic Auth Токен доступа OAuth2 Gitea, ограниченный только read:user, может выполнять полные операции записи, если он отправлен как Authorization: Basic base64:x-oauth-basic, а не как Bearer-токен. Проверка области пропускается для любого...

CVE-2020-10770-keycloak-exploit-poc

Keycloak 블라인드 SSRF POC 이 문서는 Lauritz Holtmann이 발견하고 그의 블로그 게시물에 문서화한 블라인드 SSRF CVE-2020-10770를 테스트하는 방법에 대한 단계별 가이드입니다. 그는 또한 테스트 방법을 간략히 설명했습니다. 이 문서는 더 자세한 설명입니다. 모든 공로는 Lauritz에게 있습니다. 설정 여기서는 Mac OSX에서 Docker를 사용합니다. 세 개의 셸이 필요했습니다. 하나는 Keycloak 인스턴스를 실행하고, 하나는 리스너용, 하나는 curl 요청용입니다. 방어자 버전...

oauth-scan

OAUTHScan 설명 OAUTHScan은 OAUTHv2 및 OpenID 표준을 구현하는 애플리케이션에 대한 침투 테스트 중 유용한 자동 보안 검사 기능을 제공하기 위해 Java로 작성된 Burp Suite 확장 프로그램입니다. 이 플러그인은 다양한 OAUTHv2/OpenID 취약점과 일반적인 오설정두 프레임워크의 공식 사양 기반을 탐지하며, 많은 검사 항목은 다음 참고 자료에 따라 개발되었습니다: https://datatracker.ietf.org/doc/html/rfc6749...

pocketbase-CVE-2026-44166

CVE-2026-44166: Предварительный захват учетных записей PocketBase OAuth2 Коллекция аутентификации PocketBase с включенным OAuth2 позволяет клиенту передавать объект createData при регистрации. Email внутри createData никогда не проверяется на соответствие email, подтвержденному провайдером OAuth2...

CVE-2026-82662

A flaw was found in Nodemailer where it disables Transport Layer Security TLS certificate verification. A remote attacker, positioned between the user and the server a machine-in-the-middle attack, could exploit this by intercepting OAuth2 token requests. This allows the attacker to capture...

CVE-2026-40205

A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not...

CVE-2026-73208

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...