Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
CVE-2026-70482
## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provid
#cwe-287
共收录 1081 条相关情报。
← 返回所有主题An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S...
CVE-2026-8508
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions throug
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to b...
CVE-2026-8508
CVE-2026-8508 是 Zyxel WAX650S 无线接入点固件（版本至 7.10(ABRM.4)C0）中 social_login.cgi CGI 程序存在的不当认证漏洞。该漏洞允许位于 WLAN（无线局域网）内的攻击者在无需任
A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.aspx. The manipulation results in improper authentication. I...
CVE-2026-18610
A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.asp
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If th...
CVE-2026-18651
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind cr
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored...
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0...
CVE-2026-67327
better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge th...
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-l...
CVE-2026-67327
better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-67327
better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account
better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction i...
CVE-2026-18215
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with clie...
CVE-2026-14919
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it be
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowi...
CVE-2026-14830
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an at...
CVE-2026-12695
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is ini...
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc
Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
CVE-2026-50559
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user U...
CVE-2026-63238
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, incl
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user...
CVE-2026-13690
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor log