28 matches found
CVE-2026-100528: Exposure of Sensitive Information to an Unauthorized Actor
OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...
CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...
CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
An authentication bypass vulnerability exists in the generic opaque token validation path validateOpaqueToken of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint RFC 7662, it decodes the response into an introspectResp struct. However, the...
BIT-PARSE-2026-33409 Parse Server: Auth provider validation bypass on login via partial authData
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the...
CVE-2026-33409
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowin...
CVE-2025-65431
The allauth-django library (versions before 65.13.0 ) contained a security flaw where the Okta and NetIQ implementations utilized preferred_username as the identifier for third-party provider accounts. Because this value is mutable , it should not be used for authorization decisions. The issue ha...
Mango discloses data breach at third-party provider
Mango has reported a data breach at one of its external marketing service providers. The Spanish fashion retailer says that only personal contact information has been exposed—no financial data. The breach took place at the service provider and did not affect Mango’s own systems. According to the...
EUVD-2021-10342
Malware in sbrugna...
Harrods Data Breach: 430,000 Customer Records Stolen Via Third-Party Attack
Luxury retailer Harrods confirms 430,000 customer records names, contacts were stolen from a third-party provider in the latest UK retail cyberattack wave...
Vulnerability in SICK OLM
SICK received a report about a vulnerability in the SICK Support Portal supportportal.sick.com, which was hosted and operated by a third-party service provider. Due to a misconfiguration, the access restriction of a NFS Network File System storage system has failed, which resulted in temporary...
AT&T Confirms Data Breach Affecting Nearly All Wireless Customers
American telecom service provider AT&T has confirmed that threat actors managed to access data belonging to "nearly all" of its wireless customers as well as customers of mobile virtual network operators MVNOs using AT&T's wireless network. "Threat actors unlawfully accessed an AT&T workspace on ...
Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking
A critical security vulnerability has been disclosed in the Open Authorization OAuth implementation of the application development framework Expo.io. The shortcoming, assigned the CVE identifier CVE-2023-28131, has a severity rating of 9.6 on the CVSS scoring system. API security firm Salt Labs...
GHSA-M7GV-V8XX-V47W XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...
XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...
XWiki OIDC 授权问题漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki OIDC versions prior to 1.29.1, which stems from the ability to bypass authentication altogether by providing its details to a third-party...
Security Bulletin: IBM Robotic Process Automation is vulnerable to an issue where an API could be used to perform a DNS lookup via a third party provider.
Summary IBM Robotic Process Automation is vulnerable to an issue where an API could be used to perform a DNS lookup via a third party provider. Vulnerability Details CVEID: CVE-2022-22433 DESCRIPTION: IBM Robotic Process Automation is vulnerable to External Service Interaction attack, caused by...
Broward Breach Highlights Healthcare Supply-Chain Problems
This week’s announcement by Florida’s Broward Health System that the most intimate medical data of 1,357,879 of its patients was breached in the fall should serve as a warning that the healthcare software supply chain will be a juicy target for cybercriminals as we head into 2022, researchers war...
