The vulnerability of the /api/connections file of the JWT Refresh Token Handler software platform for automated file exchange with Cleo Harmony allows a malicious actor to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the /api/connections file of the JWT Refresh Token Handler component of the software platform for automated file exchange in Cleo Harmony is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain...

PT-2026-87188

Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...

PT-2026-87057

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate...

SUSE CVE-2026-43983

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function oidcservice.go validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state befor...

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 contain an insufficient session expiration flaw: refresh tokens are not revoked when a user changes their password. An attacker holding a stolen refresh token can call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, ef...

CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

EUVD-2026-69290

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

EUVD-2026-69383

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115

Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...

PT-2026-84301

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...

GO-2026-6119 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend...

ANT-2026-CT4ZXP4Z · supabase/auth · privilege-escalation

privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CT4ZXP4Z: Parent refresh token of post-MFA token yields AAL2 without MFA In supabase/auth's...

Use of GET Request Method With Sensitive Query Strings

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...