TencentOS Server 4: python-oauthlib (TSSA-2026:1328)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1328 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-11229

The system fails to properly enforce scope authorization when the authorizeallscopes configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization,...

PT-2026-136838

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The system fails to properly enforce scope authorization when the authorize all scopes configuration is enabled. This allows applications using the client...

EUVD-2026-112488

OAuthLib: Token grants can use attacker-supplied clientid for authorization after authenticating a different client...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

PT-2026-133551

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service account API keys with unvalidated scopes. Attackers holding write api keys can mint keys with read channels and query /admin/graphql to read every...

SUSE CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

AZL-112133 CVE-2026-118669 affecting package python-oauthlib 3.2.2-4

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

UBUNTU-CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669

OAuthLib , a Python 3.6+ OAuth request-signing implementation, is vulnerable to an authorization bypass in versions prior to 4.0.0 . The client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while incorrectly ret...

CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669 OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

CVE-2026-118669: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the clientcredentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.clientid for...

PT-2026-129190

Name of the Vulnerable Software and Affected Versions OAuthLib versions prior to 4.0.0 Description In the client credentials and Resource Owner Password Credentials token grant handlers, the system can authenticate request.client as one confidential client while retaining an attacker-supplied...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

PT-2026-118041

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

CVE-2026-108748

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...