CVE-2026-63472

Vendure , an open-source headless commerce platform, is vulnerable to account takeover via its external authentication system. In ExternalAuthenticationService.createCustomerAndUser, an existing customer is matched by email address alone and a new external authentication method is attached withou...

Exploit-For-CVE-2026-18963

CVE-2026-18963 — Keycloak 未认证账户接管 CVSS 9.1 严重 · Keycloak 26.0.0 – 26.7.1 · 未认证 Keycloak 重置凭据流程中的一个严重漏洞，允许未认证攻击者通过串联认证会话处理中的两个缺陷，在无需电子邮件验证的情况下接管任意用户账户 。 漏洞详情...

CVE-2026-77614

Opencast , an open-source platform for managing educational audio and video content, is vulnerable to session fixation prior to versions 19.7 and 20.2. The default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path paramet...

CVE-2026-81637

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-82685

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

EUVD-2026-81619

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2026-88952

AshAuthentication (team-alembic, an Elixir authentication library) contains an improper authentication flaw in its OAuth2 sign-in flow. The UserResolver.resolve/3 function matches an existing account via upsert_identity keys but gates the link solely on the provider's email_verified boolean, neve...

CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

CVE-2026-81632

AshAuthenticationPhoenix (team-alembic), an Elixir authentication library for Phoenix, places a single-use sign-in token as a query parameter in a GET redirect after successful password authentication. The token travels in the request line, where it is retained by access logs, reverse proxies, an...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

CVE-2026-81637 Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

EUVD-2026-81479

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

CVE-2026-82685

AshAuthentication (ash_authentication library by team-alembic) suffers from an Authorization Bypass Through User-Controlled Key in AddOn.Confirmation.ConfirmChange. The function verifies the token's signature and act claim but never compares the sub claim against changeset.data, so a confirmation...

CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record...

CVE-2025-65676

CVE-2025-65676 Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered...

CVE-2025-9209

🍔 RestroPress – 在线订餐系统 3.0.0 - 3.1.9.2 🛡️ CVE-2025-9209.py — 批量自动利用与提取工具 ⚠️ 漏洞概述 RestroPress – 在线订餐系统 版本 3.0.0 至 3.1.9.2 存在 未认证信息泄露 ，导致 通过伪造 JWT 绕过认证 。 该插件暴露了用户的私有令牌和 API 密钥数据，允许未认证攻击者伪造 JWT 令牌，从而完全访问其他用户（包括管理员）。 CVE 编号： CVE-2025-9209 CVSS 评分： 9.8（严重） 影响： 无需事先认证即可完全接管账户。 🚀 脚本功能...

CVE-2026-92913

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses a cryptographically weak PRNG in getRandomCode() (objects/functions.php), deriving account activation/login pairing codes from uniqid() with a single non-CSPRNG rand() character as padding, reducing the code space to ~2^25 valu...