The vulnerability in the oauth2UpdateAvatarIfNeed() function of the routers/web/auth/oauth.go file in the Git repository management system Gitea allows a hacker to disclose protected information.

The vulnerability of the oauth2UpdateAvatarIfNeed function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2026-87646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a craft...

PT-2026-60913

Impact WebauthnSimpleFakeCredentialGenerator is the library-provided default implementation of the FakeCredentialGenerator interface. It returns a stable list of decoy PublicKeyCredentialDescriptor objects for a given username so that an assertion request for an unknown user looks the same as a...

CVE-2026-9733

The Mojolicious::Plugin::Web::Auth::OAuth2 module for Perl (versions through 0.17 ) contains an insecure default state parameter . When no state generator is specified in the constructor, the module generates a SHA-1 hash using predictable, low-entropy sources, including the epoch time (leaked vi...

CVE-2026-9733: Generation of Predictable Numbers or Identifiers

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time which is leaked via t...

CVE-2026-36808

The Tenda W15E wireless router, running firmware version v15.11.0.10 , is susceptible to a buffer overflow vulnerability within the formAddWebAuthUser function. The issue occurs because the software fails to properly check the size of the input when processing the webAuthUserInfo parameter, leadi...

CVE-2026-36823

The Tenda W20E router (version 15.11.0.6 ) is vulnerable to a stack-based buffer overflow in the formAddWebAuthUser function. The root cause is improper memory handling when processing the webAuthUserInfo parameter. An unauthenticated attacker can exploit this by sending a specially crafted HTTP ...

CVE-2026-30964: Origin Validation Error

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...

CVE-2025-14572

The CVE-2025-14572 entry covers a memory-corruption vulnerability in UTT Progressive 512W devices (UTT 进取 512W) up to version 1.7.7-171114. The flaw resides in the /goform/formWebAuthGlobalConfig handler, where manipulating the hidcontact parameter can trigger memory corruption, enabling remote e...

UTT 512W 缓冲区错误漏洞

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. The UTT Progress 512W suffers from a memory corruption vulnerability that originates...

Malicious code in web-auth-client (npm)

The package web-auth-client was found to contain malicious code...

MAL-2025-38967 Malicious code in web-auth-client (npm)

The package web-auth-client was found to contain malicious code...

Malware in vss-web-auth-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5971 Malicious code in vss-web-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70dc7c0837db09d1f3b1d98483b9ce346b56d8ea5ae46ee6b2d974d8be75ea26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Username Enumeration

web-auth/webauthn-framework and web-auth/webauthn-lib are vulnerable to Username Enumeration. The vulnerability is due to the ProfileBasedRequestOptionsBuilder method returning allowedCredentials without any credentials if no username was found. This allows an attacker to enumerate valid username...

CVE-2024-39912 Enumeration of valid usernames in web-auth/webauthn-lib

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...

CVE-2024-39912

CVE-2024-39912 affects web-auth/webauthn-lib (PHP/Symfony) where ProfileBasedRequestOptionsBuilder returns allowedCredentials without credentials if no username is found, enabling username enumeration when WebAuthn is used as the first/only authentication method. Documented impact is enumeration ...

PT-2024-5621

Name of the Vulnerable Software and Affected Versions web-auth/webauthn-lib versions prior to 4.9.0 Description The issue is related to the ProfileBasedRequestOptionsBuilder method in the web-auth/webauthn-lib library, which returns allowedCredentials without any credentials if no username was...

CVE-2024-39912: Observable Response Discrepancy

web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...

SUSE CVE-2020-6823

A malicious extension could have called browser.identity.launchWebAuthFlow, controlling the redirecturi, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox 75...