GHSA-4V2W-2WQP-MC85 OpenAM OAuth Authorization Bypass via PKCE Challenge

Summary Description An Improper Authorization CWE-285 issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authorization code to be redeemed without the required codeverifier. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. The...

CVE-2026-40948

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

PT-2023-30745

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.5 authentik versions prior to 2023.10.4 Description The issue concerns the implementation of the Proof Key for Code Exchange PKCE in authentik, an open-source identity provider. When initializing an OAuth2 fl...