askWAM

askWAM askWAM solicita tokens de acceso de Microsoft Entra de forma silenciosa a través del Administrador de cuentas web de Windows WAM. Se distribuye como un cliente de .NET Framework, un cliente nativo x64 independiente y un Beacon Object File x64 con un adaptador de comandos CNA. Todos los...

CVE-2026-96446

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-96446

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

EUVD-2026-85221

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-96446 Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

CVE-2026-96446

A flaw exists in the Keycloak Pushed Authorization Request (PAR) implementation where the silent authentication path (prompt=none ) allows the authorization process to skip specific steps for already logged-in users. This bypass prevents the enforcement of the security rule requiring a pushed req...

CVE-2026-96446: Missing Authorization

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

Attackers abuse OAuth’s built-in redirects to launch phishing and malware attacks

Attackers are abusing normal OAuth error redirects to send users from a legitimate Microsoft or Google login URL to phishing or malware pages, without ever completing a successful sign‑in or stealing tokens from the OAuth flow itself. That calls for a bit more explanation. OAuth Open Authorizatio...

CVE-2022-26950

Archer 6.x through 6.9 P2 6.9.0.2 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to t...

PT-2022-18136

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.9 P2 6.9.0.2 Description The issue allows a remote unprivileged attacker to potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims'...

CVE-2020-29537

Archer before 6.8 P2 6.8.0.2 is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Arch...