CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67611

OpenEMR up to version 8.2.0 is affected by an authentication bypass via the OAuth2 password grant flow exposed through an unauthenticated client registration endpoint. The vulnerability enables an attacker with valid credentials to register an OAuth2 client via the unauthenticated endpoint and th...

EUVD-2026-52348

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67611 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

CVE-2026-67611: Use of Single-factor Authentication

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

keycloak: Keycloak: Security restriction bypass allows unauthorized ROPC token acquisition

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

GHSA-33J3-G875-37RP Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

EUVD-2026-32708

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers client-type, client-roles, client-attributes, client-scopes are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed...

CVE-2026-34736

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users...

com.nimbusds:c2id-server-sdk (2.0.6), com.nimbusds:oauth-client-grant-handler (1.1) +5 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.2.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:c2id-server-sdk 2.0.6 - com.nimbusds:oauth-client-grant-handler 1.1 -...

CVE-2024-12056

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit...

CVE-2024-12056 Client Secret not checked with OAuth Password grant type

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit...

CVE-2024-12056

The CVE-2024-12056 entry affects PcVue (versions 12.0–16.2.0) where the Client Secret is not checked when using the OAuth Password grant type. Root cause is failure to validate the client secret during OAuth authentication, enabling a attacker with valid credentials to connect to a web server usi...

PT-2024-17418

Name of the Vulnerable Software and Affected Versions OAuth affected versions not specified Description The issue arises when using the OAuth Password grant type, as the Client secret is not checked. This allows an attacker to connect to a web server using a client application that is not...

PcVue security vulnerabilities

PcVue is a reliable, secure, and powerful operational software platform from PcVue, Inc. dedicated to monitoring and controlling applications in markets such as building and campus management. A security vulnerability exists in PcVue versions 12.0 through 16.2.0 that stems from the use of the OAu...

CVE-2024-12056: Improperly Implemented Security Check for Standard

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit...

com.nimbusds:c2id-server-sdk (2.0.6), com.nimbusds:oauth-client-grant-handler (1.1) +5 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (3.2.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:c2id-server-sdk 2.0.6 - com.nimbusds:oauth-client-grant-handler 1.1 -...

CVE-2022-2303

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Passwo...