PT-2026-81964

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

PT-2026-82215

Name of the Vulnerable Software and Affected Versions one-api affected versions not specified Description An issue exists in middleware/auth.go where one of two channel-pinning paths is not properly gated. While requests using a suffix on the API key require model.IsAdmin to succeed, requests usi...

PT-2026-81974

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

CVE-2026-81029: URL Redirection to Untrusted Site

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

Linux Distros Unpatched Vulnerability : CVE-2026-80182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived...

PT-2026-82224

Name of the Vulnerable Software and Affected Versions Stalwart Mail Server affected versions not specified Description In its default configuration, the server fails to validate OAuth redirect targets against registered destinations. The validation routine in...

PT-2026-82217

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0 Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods within its Twig invoice template sandbox , allowing privileged users to invoke getApiToken() and getPlainApiToken(). Attackers holding template creation permissions can embed these method calls in invoice templates, causing hashed API toke...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-44476

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

DEBIAN-CVE-2026-44476

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-18259

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-44476

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

EUVD-2026-66188

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476

doorkeeper-openid_connect (an OpenID Connect extension for the Doorkeeper OAuth 2 gem in Ruby on Rails) is affected in version 1.9.0 . The root cause is in DynamicClientRegistrationController#register, which hard-codes confidential: false when creating dynamically registered applications, yet sti...