CVE-2026-51416

1. 摘要 漏洞类型 ：拒绝服务 / 无限制 HTTP 响应读取（CWE-400） 标记位置 ：backend/internal/handler/authwechatoauth.go:1149 漏洞描述 ：微信 OAuth 令牌交换过程使用 io.ReadAllresp.Body 将完整的上游 HTTP 响应体读入内存，在缓冲之前未强制执行任何最大大小限制。 2. 分析 步骤 1：检查 backend/internal/handler/authwechatoauth.go:1124 处标记的接收点 已审查标记函数及其周围 50 多行上下文。接收点是令牌交换辅助函数...

ROADtools

ROADtools R ogue O ffice 365 および A zure アクティブ D irectory ツール ROADtools は Azure AD と対話するためのフレームワークです。共通コンポーネントからなるライブラリ roadlib、Azure AD 探索ツール ROADrecon、および ROADtools Token eXchange roadtx ツールで構成されています。 ROADlib ROADlib は、Azure AD での認証や、ROADrecon データを含むデータベースと統合するツールの構築に使用できるライブラリです。ROADlib...

kit-oauth

kit-oauth KitアプリケーションのためのOAuth 2.0クライアントライブラリ TOC ファイル ファイル| 説明 ---|--- .editorconfig| エディタの書式設定 .gitignore| ビルド成果物と依存関係のGit無視ルール .tool-versions| asdfツールバージョン Zig, Kit LICENSE| MITライセンスファイル README.md| このファイル examples/client-credentials.kit| ドライランのクライアントクレデンシャル例 examples/github.kit|...

CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

TokenMan

访问和刷新令牌套件。 Token Man 是一款使用 AAD 访问令牌和/或刷新令牌来支持后渗透活动的工具。 目录 用法 命令 Fetch Search Swap FOCI 应用程序客户端 ID 映射 AZ OAuth 用法 usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -- v0.1.1 positional arguments: fetch,search,swap,az,oauth Command fetch Retrieve data via Graph API search Search conten...

PYSEC-2026-4129 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this...

PYSEC-2026-4119 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105868

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

The Keycloak-services component contains a vulnerability where the new Standard Token Exchange V2 feature fails to validate the digital certificate required for mTLS holder-of-key binding . This flaw allows an attacker possessing stolen client credentials to obtain a standard, unrestricted token,...

EUVD-2026-86530

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint...

PT-2026-98320

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 Description An issue exists where public Relying Parties in PKCE or secret mode can bypass Proof Key for Code Exchange PKCE, a security extension for OAuth 2.0 that prevents authorization co...

PT-2026-98361

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak includes an mTLS holder-of-key binding feature designed to ensure tokens are only usable by the client that originally requested them by binding the token to a digital certificate. ...