CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | Bypass de Autenticación SSO de FortiCloud Resumen Ejecutivo FortiCloud Single-Sign-On SSO, una función habilitada por defecto de fábrica una vez que registras cualquier FortiGate/FortiManager/FortiAnalyzer, contiene una vulnerabilidad crítica de bypass de autenticación. Un atacan...

CVE-2026-103869

A flaw exists in pulp-ansible regarding the bearer-token refresh mechanism for collection remotes. The application incorrectly stores the access token in a module-level variable , causing it to be reused for every token download within a worker. An attacker capable of syncing an Ansible remote wi...

CVE-2026-103869 Pulp-ansible: bearer tokens are reused across remotes in a worker

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they...

CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-83540

The wolfSSHd Windows port is vulnerable to a race condition in versions 1.4.15 through 1.5.0 . When using password or public key authentication, the Windows logon token from one authenticated connection is not released before being reused for a subsequent connection. This flaw can lead to user lo...

CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358

Cloud Foundry UAA (v3.7.0 to v79.6.0) and CF Deployment (up to v60.4.0) are vulnerable to an Improper Authentication (CWE-287) flaw in the OAuth token endpoint. The system fails to verify if a Bearer credential is a legitimate client secret, instead accepting any valid access token where the clie...

CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — Meta-Phishing Facebook Graph API — Reutilización de Tokens OAuth y Secuestro de Sesión Campo| Valor ---|--- Severidad| 9.6 Crítica Vector| Red Versiones Afectadas| Graph API v18.0 – v20.0 Descubierto Por| 𝕍𝕠𝕤𝕤🥷 Descripción Una vulnerabilidad crítica en la Graph API de Facebook...

CVE-2025-56643

CVE-2025-56643 CVE-2025-56643 的公开参考 – Wiki.js 2.5.307 JWT 会话漏洞 描述： Requarks Wiki.js 2.5.307 在用户登出时未能正确撤销或使活跃的 JWT 令牌失效。 因此，先前发放的令牌仍然有效，可在登出后重新用于访问系统。 此行为影响会话完整性，若令牌泄露，可能导致未经授权的访问。 该问题存在于身份验证解析器逻辑中，影响 GraphQL 端点及登出机制。 受影响产品： Wiki.js – 版本 2.5.307 受影响组件： GraphQL API 端点（/graphql）、认证模块、JWT 会话管理、登出逻辑（U...

CVE-2020-24030

CVE-2020-24030 Descripción ForLogic Qualiex v1 y v3 tiene una expiración de token débil. Esto permite la escalada de privilegios remota no autenticada y el acceso a datos sensibles mediante la reutilización de tokens. Fechas importantes Anuncio al proveedor: 2020-07-12 Fecha de divulgación públic...

CVE-2026-92899: Authentication Bypass by Spoofing

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...