EUVD-2026-77577

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

CVE-2026-88819

Siglet (current and all past versions) contains a vulnerability in its refresh token handler , which does not enforce proof of possession of the issuer DID. This lack of enforcement means an attacker could potentially use a refresh token without demonstrating control over the associated decentral...

PT-2026-91253

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

EUVD-2026-73162

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution...

GHSA-CW9W-VV67-HF73 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...

CVE-2026-86073

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073

n8n , an open source workflow automation platform, is affected by a per-resource OAuth consent bypass prior to versions 2.37.7 and 2.38.1 . The OAuth token endpoint bound the initial access token to the consented resource but did not bind the refresh token ; upon refreshing, it only verified the ...

Exploit for CVE-2026-73312

CVE-2026-73312 XenForo before 2.3.13 can leave an OAuth2 refr...

CVE-2026-73312

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...

CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...

EUVD-2026-72783

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...

CVE-2026-73312

XenForo versions before 2.3.13 contain a refresh token replay vulnerability in the authentication token mechanism. The root cause is the failure to mark refresh tokens as consumed when the parent access token has expired, allowing an attacker to repeatedly submit the same refresh token to generat...

CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...