AIIR verification and policy gates could report success without enforcing the control (fail-open)

Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could fail open rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have...

GHSA-73P9-6HRP-8QHR AIIR verification and policy gates could report success without enforcing the control (fail-open)

Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could fail open rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have...

NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

GHSA-86M2-FCXQ-5Q7C 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Summary 9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can...

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Summary 9router's request guard decides a request is "local" and therefore exempt from API-key auth on the /v1 LLM proxy by reading the client-controlled Host header. Because 9router binds 0.0.0.0 by default and the CLI misleadingly prints "localhost", a remote, unauthenticated attacker who can...

GHSA-WG2F-X2C2-C4RP Snipe-IT has an Open Redirect After User Edit

Impact The user edit flow stores url-previous into Laravel's intended URL session value and later redirects with redirect-intended... when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal...

Snipe-IT has an Open Redirect After User Edit

Impact The user edit flow stores url-previous into Laravel's intended URL session value and later redirects with redirect-intended... when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal...

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...

GHSA-2WVM-8MVP-22QV Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Summary The OIDC authorization page in the pocket-id frontend redirects the browser to an attacker-controlled URL without consulting the backend redirecturi allow-list when the request uses prompt=none. An attacker who knows a valid clientid can craft an /authorize link that sends a victim or a...

EUVD-2026-67828

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

CVE-2026-55834

Pocket ID (an OIDC provider for passkey-based authentication), versions 2.6.0 through 2.9.0 , contains an open redirect in its OIDC /authorize page. When a request uses prompt=none and silent authorization cannot complete, the SvelteKit frontend constructs a callback URL directly from the raw red...

CVE-2026-55834 Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82274

Twenty through version 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint. The root cause is that the state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary ho...

CVE-2026-82274

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

EUVD-2026-67805

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...