keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-65632

A flaw was found in jose. When verifying Elliptic Curve Digital Signature Algorithm ECDSA signatures, the library does not enforce fixed signature lengths and ignores leading zero bytes. An attacker with a valid token can alter the signature format while keeping it cryptographically valid, causin...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken Never Re-Validates Account State Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 High CNA: Turan Security · CVE record Description Shiori's CheckToke...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-6647 Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

EUVD-2026-112401

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, "nora-registry" authenticates the token-management UI but fails to require administrator authorization. "authmiddleware" protects "/ui/tokens" and "/api/ui/tokens", but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

EUVD-2026-112076

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

CVE-2026-59164 NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

Vulnerability related to session mechanism issues in WSO2 Identity Server

Versions 7.2.0 through 7.2.0.21 of WSO2 Identity Server and versions 7.0.385 through 7.0.385.17 of WSO2 Carbon OAuth contain a session mechanism vulnerability. This vulnerability stems from inconsistent handling of usernames in uppercase and lowercase between user storage that is case-insensitive...

CVE-2026-59164: Missing Authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...

PT-2026-129164

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

PT-2026-128248

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...

CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's...