26 matches found
CVE-2026-107162
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that...
EUVD-2026-94316
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that...
CVE-2026-107162 Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that...
CVE-2026-107162
Express Gateway versions through 1.16.11 are vulnerable to an authentication bypass in the OAuth 2.0 refresh_token grant. The root cause is a failure to validate the token secret or the issuing client . An attacker possessing valid client credentials and the identifier portion of another user's r...
CVE-2026-107162 Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that...
Linux Distros Unpatched Vulnerability : CVE-2026-104850
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and...
CVE-2026-107162: Improper Authentication
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
EUVD-2026-94061
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
CVE-2026-101023
A flaw in Gitea allows an attacker or user to maintain persistent access to the application. The OAuth2 token endpoint validates the signature and grant of a token submitted with the refresh_token grant type but fails to verify that the submitted token is specifically a refresh token . Consequent...
CVE-2026-104850
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...
CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...
CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...
CVE-2026-104850
The MCP TypeScript SDK (versions 1.12.0 through 1.30.1) and @modelcontextprotocol/client (versions 2.0.0 through 2.1.0) are vulnerable to a flaw where the SDK's OAuth client allows a connected MCP server to dictate which authorization server receives client credentials. Because credentials were n...
CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...
GHSA-6QXP-VCCF-F47H MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...
CVE-2026-101023: Improper Authentication
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...