keycloak-services: keycloak-services: UMA scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

CVE-2026-49272

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

CVE-2026-49272 OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

CVE-2026-49272

The OAuthLib library (Python 3.6+) contains a vulnerability in its RFC 8628 device workflow affecting versions 3.3.0 through 4.0.1 . The root cause is that the DeviceCodeGrant.validate_token_request method fails to verify that the device_code parameter is present and valid. Consequently, an attac...

CVE-2026-4052

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052

CVE-2026-4052 affects WSO2 API Manager (APIM 4.x) when the WSO2 Identity Server is configured as a Resident Key Manager with database sharing . The vulnerability allows a self-registered user to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO...

EUVD-2026-114794

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

PT-2026-134870

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2026-73310

CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the token endpoint grant handlers validatetokenrequest in authorizationcode.py, clientcredentials.py, resourceownerpasswordcredentials.py, and related grant types due to a missing cross-check between the...

OAuthLib: Bearer Token Can Be Retrieved As Long As Client Knows A Valid Client ID For Device Workflow

Summary A call to the token endpoint with a grant type of ""urn:ietf:params:oauth:grant-type:devicecode"" and a bogus "devicecode" is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details "Section 3.4 of the RFC 8628 spec"...

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

Summary A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:devicecode" and a bogus devicecode is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details Section 3.4 of the RFC 8628 spec says that the token endpoin...

GHSA-3JP2-3MRG-2VXC OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

Summary A call to the token endpoint with a grant type of "urn:ietf:params:oauth:grant-type:devicecode" and a bogus devicecode is able to get a bearer token as long as they know a valid client ID enabled for the device workflow. Details Section 3.4 of the RFC 8628 spec says that the token endpoin...

PT-2026-127191

Name of the Vulnerable Software and Affected Versions OAuthLib versions 3.3.0 through 4.0.0 Description The RFC 8628 device workflow fails to verify the presence and validity of the device code parameter. In the DeviceCodeGrant.validate token request function, the lack of validation allows an...

CVE-2026-101023

A flaw was found in Gitea. The OAuth2 Open Authorization token endpoint validates the signature and grant of a token during a refresh request, but fails to confirm that the submitted token is specifically a refresh token. An attacker or user possessing a valid, unexpired access token can exchange...

CVE-2026-101023

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-101023

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the "refreshtoken" grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token...