Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
550 results · page 8 of 11
Apr 10, 2024OAuth Server: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31253 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
- Product
- OAuth Server
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2024OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 prCVE-2024-29033 · Other software · jupyterhub · reported by GitHubHigh 7.5
OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.
- Product
- oauthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024Analytics Insights for Google Analytics 4 (AIWP): Is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callbackCVE-2024-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Analytics Insights for Google Analytics 4 (AIWP)
- Fixed in
- 6.3
- What to do
- Update Analytics Insights for Google Analytics 4 (AIWP) to 6.3 or newer.
Feb 6, 2024Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.CVE-2023-40545 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 8.8
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
- Product
- PingFederate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.comsupport.pingidentity.com
Jan 30, 2024Authentik is an open-source Identity Provider.CVE-2024-23647 · Other software · goauthentik · reported by GitHubMedium 6.5
Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token request. Prior to 2023.8.7 and 2023.10.7, a downgrade scenario is possible: if the attacker removes the code_challenge parameter from the authorization request, authentik will not do the PKCE check. Because of this bug, an attacker can circumvent the protection PKCE offers, such as CSRF attacks and code injection attacks. Versions 2023.8.7 and 2023.10.7 fix the issue.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Authentik is an open-source Identity Provider.CVE-2024-21637 · Other software · goauthentik · reported by GitHubHigh 7.6
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50714 · Other software · yiisoft · reported by GitHubMedium 6.8
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50708 · Other software · yiisoft · reported by GitHubMedium 6.1
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2023An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled.CVE-2023-49104 · Other software · Owncloud · reported by MITREHigh 8.7
An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.
- Product
- Oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordowncloud.comowncloud.org
Nov 21, 2023authentik is an open-source identity provider.CVE-2023-48228 · Other software · goauthentik · reported by GitHubHigh 7.5
authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a `code_challenge`. authentik 2023.8.5 and 2023.10.4 fix this issue.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023authentik is an open-source Identity Provider.CVE-2023-46249 · Other software · goauthentik · reported by GitHubCritical 9.6
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023light-oauth2 before version 2.1.27 obtains the public key without any verification.CVE-2023-31580 · Other software · Networknt · reported by MITREMedium 5.9
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
- Product
- Light-oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2023Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4CVE-2023-44311 · Other software · Liferay · reported by security@liferay.comCritical 9.6
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
- Product
- DXP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
Oct 16, 2023com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations.CVE-2023-45144 · Other software · xwikisas · reported by GitHubCritical 10
com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.
- Product
- identity-oauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2023A content spoofing flaw was found in OpenShift's OAuth endpoint.CVE-2022-4145 · Other software · Red Hat · reported by Red HatMedium 4.3
A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation.
- Product
- Red Hat OpenShift Container Platform 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2023A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling.CVE-2022-4137 · Other software · Red Hat · reported by Red HatHigh 8.1
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.
- Product
- Red Hat Single Sign-On 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 29, 2023goauthentik is an open-source Identity Provider.CVE-2023-39522 · Other software · goauthentik · reported by GitHubMedium 5.3
goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recovery flow described above is susceptible to having their username/email revealed as existing. An attacker can easily enumerate and check users' existence using the recovery flow, as a clear message is shown when a user doesn't exist. Depending on configuration this can either be done by username, email, or both. This issue has been addressed in versions 2023.5.6 and 2023.6.2. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.CVE-2023-26451 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.5
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.23.3
- What to do
- Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codespatchstack.com
Jul 6, 2023authentik is an open-source Identity Provider.CVE-2023-36456 · Other software · goauthentik · reported by GitHubHigh 8.3
authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used. This poses a possible security risk when someone has flows or policies that check the user's IP address, e.g. when they want to ignore the user's 2 factor authentication when the user is connected to the company network. A second security risk is that the IP addresses in the logfiles and user sessions are not reliable anymore. Anybody can spoof this address and one cannot verify that the user has logged in from the IP address that is in their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to. Versions 2023.4
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP.CVE-2023-37260 · Other software · thephpleague · reported by GitHubHigh 8.2
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.
- Product
- oauth2-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2023All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.CVE-2023-31999 · Other software · npm · reported by support@hackerone.comHigh 8.8
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
- Product
- @fastify/oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent accesCVE-2023-2788 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.2
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 12, 2023Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.CVE-2023-34246 · Other software · doorkeeper-gem · reported by GitHubMedium 4.2
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
- Product
- doorkeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possibleCVE-2023-34224 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 24, 2023Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 throCVE-2023-33941 · Other software · Liferay · reported by security@liferay.comMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
May 16, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker'sCVE-2023-33006 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
- Product
- Jenkins WSO2 Oauth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.CVE-2023-33005 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.
- Product
- Jenkins WSO2 Oauth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate CVE-2023-2193 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 19, 2023Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.CVE-2023-22893 · Other software · Strapi · reported by MITREHigh 7.5
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers toCVE-2023-30528 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.
- Product
- Jenkins WSO2 Oauth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Apr 12, 2023Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can bCVE-2023-30527 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins WSO2 Oauth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 27, 2023OAuth Single Sign On: Does not have CSRF checksCVE-2023-1093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
- Product
- OAuth Single Sign On
- Fixed in
- 6.24.2
- What to do
- Update OAuth Single Sign On to 6.24.2 or newer.
Mar 27, 2023The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPreCVE-2023-1092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
- Fixed in
- 6.24.2
- What to do
- Update the plugin to 6.24.2 or newer.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.3.0
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.3.0 or newer.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.5
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Mar 15, 2023A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the viCVE-2023-1421 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Mar 6, 2023rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session.CVE-2023-27891 · Other software · Rami · reported by MITREHigh 7.5
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
- Product
- Pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023authentik is an open-source Identity Provider.CVE-2023-26481 · Other software · goauthentik · reported by GitHubCritical 9.1
authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgoauthentik.io
Jan 26, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attaCVE-2023-24428 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.7
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
- Product
- Jenkins Bitbucket OAuth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.CVE-2023-24427 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
- Product
- Jenkins Bitbucket OAuth Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022authentik is an open-source Identity provider focused on flexibility and versatility.CVE-2022-46172 · Other software · goauthentik · reported by GitHubMedium 6.4
authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022authentik is an open-source Identity Provider focused on flexibility and versatility.CVE-2022-23555 · Other software · goauthentik · reported by GitHubCritical 9.4
authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow than in the one provided. The vulnerability allows an attacker that knows different invitation flows names (e.g. `enrollment-invitation-test` and `enrollment-invitation-admin`) via either different invite links or via brute forcing to signup via a single invitation url for any valid invite link received (it can even be a url for a third flow as long as it's a valid invite) as the token used in the `Invitations` section of the Admin interface does NOT change when a different `enrollment flow` is selected via the interface and it is NOT bound to the selected flow, so it will be valid for any flow when used. This issue is patched in authentik 2022.11.4,2022.10.4 and 2022.12.0. Only configurations that use invitations and have multiple enrollment flows with invitation stages that grant different permissions are affected. The default configuration is not vulnerable, and neither are configurations with a single enrol
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 iCVE-2020-36569 · Other software · github.com/nanobox-io/golang-nanoauth · reported by security@golang.orgCritical 9.1
Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
- Product
- github.com/nanobox-io/golang-nanoauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that UCVE-2020-15679 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.6
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).
- Product
- Mozilla VPN iOS 1.0.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.CVE-2022-38488 · Other software · Logrocket-oauth2-example Project · reported by MITRECritical 9.8
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
- Product
- Logrocket-oauth2-example
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3926 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 3.4.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 3.4.2 or newer.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.2 or newer.
Dec 2, 2022authentik is an open-source identity provider.CVE-2022-46145 · Other software · goauthentik · reported by GitHubHigh 8.1
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.
- Product
- authentik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgoauthentik.io
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication.CVE-2022-43687 · Other software · Concretecms · reported by MITREMedium 5.4
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.