Monthly
Unauthenticated remote attackers can steal OAuth2 authorization codes from smart-sso deployments running version 2.1.1 or earlier by abusing an unvalidated redirectUri parameter in the /login handler (CWE-601). A victim who already holds an active SSO session must be induced into opening a crafted /login link, after which the attacker - who must additionally hold any valid OAuth2 client credentials - redeems the leaked code at /oauth2/access_token to obtain the victim's access token, giving both high confidentiality and integrity impact (CVSS 7.6 v4.0: AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation is conditional rather than trivial: it fails if the victim has no active session, does not click the link, or if the attacker lacks valid client credentials, though no authentication to the SSO server itself is required (PR:N). No public exploit identified at time of analysis, although a public technical writeup describing the authorization-code leak path has been published; this is a genuine but conditional risk rather than a drop-everything emergency.
Improper validation of the reset_url parameter in the Checkmk Setup in-page search lets an unprivileged remote attacker craft a URL that, once opened by an authenticated user holding Setup access, executes arbitrary script in that user's session or redirects the user to an arbitrary external site - but only when the victim clicks the Reset button or submits an empty search, since the payload does not fire on page load. Affected are Checkmk releases before 2.5.0p15, before 2.4.0p38, before 2.3.0p51, and the end-of-life 2.2.0 branch; fully patched instances are not exploitable. No public exploit code has been identified at time of analysis, and exploitation depends on successful social engineering of a privileged Setup user combined with mandatory user interaction.
Open redirect flaw in the OAuth1 callback validation of Apache Allura through 1.21.0 allows unauthenticated remote attackers to redirect users to arbitrary attacker-controlled URLs during the OAuth authorization flow (CWE-601), potentially exposing authorization codes or tokens if a victim completes the flow. Exploitation is not drive-by: per the independent assessment a user must be induced to traverse the attacker-influenced OAuth request (UI:R), which lowers real-world risk below the supplied 9.1 base score; the vendor patched the issue in Allura 1.22.0, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile), so this is assessed as a moderate real-world priority.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated remote attacker who can control the HTTP Host header on a request reaching the server to make Nezha emit an attacker-chosen redirect_uri to the configured identity provider; a victim induced to start the OAuth2 login/binding flow can then have their authorization code delivered to the attacker's origin, letting the attacker complete the flow and take over the account. The bug is a regression of the GHSA-9rc6-8cjv-rcvx fix and only manifests when the new optional dashboard_host setting is left empty, so the code no longer falls back to install_host; exploitation also requires victim interaction and an identity provider that accepts the forged redirect URI, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R while the vendor-style CVSS 4.0 rating is 9.3. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; no patched release version was published with the advisory, only an upstream fix commit (38824dbc11a63964c5b9296ae4c68e62b34fa04b).
Credential disclosure in Apple Containerization versions before 0.41.0 allows an unauthenticated remote attacker who controls or impersonates a container registry to redirect the client's token request to an attacker-chosen host via an open redirect, leaking the victim's registry credentials. The victim must initiate a pull or authentication flow against the adversarial registry, and upgrading to 0.41.0 remediates the flaw. CISA SSVC records no known exploitation, and no public exploit code was identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
OAuth Dynamic Client Registration redirect URI validation bypass in Mattermost 11.7.x (through 11.7.7), 11.8.x (through 11.8.4) and 11.9.0 lets a remote unauthenticated attacker register an OAuth client whose attacker-controlled callback host evades the configured redirect URI allowlist, so authorization responses can be sent to a host the attacker controls. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) confirms no authentication is needed to register the client, but a legitimate user must still be induced to complete the OAuth authorization flow for the malicious client, which makes the attack non-automatable per SSVC (Exploitation: none, Automatable: no) despite a total technical impact rating. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.28% (roughly 20th percentile); the practical risk is a serious but not urgent credential/interception exposure confined to deployments that expose OAuth with Dynamic Client Registration.
Credential exfiltration in Renovate (renovatebot/renovate) before 44.11.2 lets a malicious or compromised container registry steal the registry credentials Renovate holds. When enumerating container image tags/digests, Renovate follows an HTTP Link header pagination URL and re-attaches the original registry's credentials without checking that the follow-up URL shares the same origin (CWE-601 open redirect), so a hostile registry can redirect the authenticated request to an attacker-controlled host and capture the secrets. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not in CISA KEV.
Credential exfiltration in Renovate before 44.11.2 (and Mend Renovate CE/EE images/charts before 15.4.0, enterprise-edition helm chart before 10.4.0) lets a malicious or compromised NuGet registry harvest the configured registry credentials by returning an HTTP Link header whose 'next' pagination URL points to an attacker-controlled host. Renovate followed cross-origin pagination targets without an origin check and re-attached the registry credentials, delivering them to an arbitrary attacker-chosen server. Classified as an open redirect (CWE-601); no public exploit is identified at time of analysis and it is not in CISA KEV.
Unauthenticated remote attackers can steal OAuth2 authorization codes from smart-sso deployments running version 2.1.1 or earlier by abusing an unvalidated redirectUri parameter in the /login handler (CWE-601). A victim who already holds an active SSO session must be induced into opening a crafted /login link, after which the attacker - who must additionally hold any valid OAuth2 client credentials - redeems the leaked code at /oauth2/access_token to obtain the victim's access token, giving both high confidentiality and integrity impact (CVSS 7.6 v4.0: AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation is conditional rather than trivial: it fails if the victim has no active session, does not click the link, or if the attacker lacks valid client credentials, though no authentication to the SSO server itself is required (PR:N). No public exploit identified at time of analysis, although a public technical writeup describing the authorization-code leak path has been published; this is a genuine but conditional risk rather than a drop-everything emergency.
Improper validation of the reset_url parameter in the Checkmk Setup in-page search lets an unprivileged remote attacker craft a URL that, once opened by an authenticated user holding Setup access, executes arbitrary script in that user's session or redirects the user to an arbitrary external site - but only when the victim clicks the Reset button or submits an empty search, since the payload does not fire on page load. Affected are Checkmk releases before 2.5.0p15, before 2.4.0p38, before 2.3.0p51, and the end-of-life 2.2.0 branch; fully patched instances are not exploitable. No public exploit code has been identified at time of analysis, and exploitation depends on successful social engineering of a privileged Setup user combined with mandatory user interaction.
Open redirect flaw in the OAuth1 callback validation of Apache Allura through 1.21.0 allows unauthenticated remote attackers to redirect users to arbitrary attacker-controlled URLs during the OAuth authorization flow (CWE-601), potentially exposing authorization codes or tokens if a victim completes the flow. Exploitation is not drive-by: per the independent assessment a user must be induced to traverse the attacker-influenced OAuth request (UI:R), which lowers real-world risk below the supplied 9.1 base score; the vendor patched the issue in Allura 1.22.0, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile), so this is assessed as a moderate real-world priority.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated remote attacker who can control the HTTP Host header on a request reaching the server to make Nezha emit an attacker-chosen redirect_uri to the configured identity provider; a victim induced to start the OAuth2 login/binding flow can then have their authorization code delivered to the attacker's origin, letting the attacker complete the flow and take over the account. The bug is a regression of the GHSA-9rc6-8cjv-rcvx fix and only manifests when the new optional dashboard_host setting is left empty, so the code no longer falls back to install_host; exploitation also requires victim interaction and an identity provider that accepts the forged redirect URI, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R while the vendor-style CVSS 4.0 rating is 9.3. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; no patched release version was published with the advisory, only an upstream fix commit (38824dbc11a63964c5b9296ae4c68e62b34fa04b).
Credential disclosure in Apple Containerization versions before 0.41.0 allows an unauthenticated remote attacker who controls or impersonates a container registry to redirect the client's token request to an attacker-chosen host via an open redirect, leaking the victim's registry credentials. The victim must initiate a pull or authentication flow against the adversarial registry, and upgrading to 0.41.0 remediates the flaw. CISA SSVC records no known exploitation, and no public exploit code was identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
OAuth Dynamic Client Registration redirect URI validation bypass in Mattermost 11.7.x (through 11.7.7), 11.8.x (through 11.8.4) and 11.9.0 lets a remote unauthenticated attacker register an OAuth client whose attacker-controlled callback host evades the configured redirect URI allowlist, so authorization responses can be sent to a host the attacker controls. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) confirms no authentication is needed to register the client, but a legitimate user must still be induced to complete the OAuth authorization flow for the malicious client, which makes the attack non-automatable per SSVC (Exploitation: none, Automatable: no) despite a total technical impact rating. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.28% (roughly 20th percentile); the practical risk is a serious but not urgent credential/interception exposure confined to deployments that expose OAuth with Dynamic Client Registration.
Credential exfiltration in Renovate (renovatebot/renovate) before 44.11.2 lets a malicious or compromised container registry steal the registry credentials Renovate holds. When enumerating container image tags/digests, Renovate follows an HTTP Link header pagination URL and re-attaches the original registry's credentials without checking that the follow-up URL shares the same origin (CWE-601 open redirect), so a hostile registry can redirect the authenticated request to an attacker-controlled host and capture the secrets. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not in CISA KEV.
Credential exfiltration in Renovate before 44.11.2 (and Mend Renovate CE/EE images/charts before 15.4.0, enterprise-edition helm chart before 10.4.0) lets a malicious or compromised NuGet registry harvest the configured registry credentials by returning an HTTP Link header whose 'next' pagination URL points to an attacker-controlled host. Renovate followed cross-origin pagination targets without an origin check and re-attached the registry credentials, delivering them to an arbitrary attacker-chosen server. Classified as an open redirect (CWE-601); no public exploit is identified at time of analysis and it is not in CISA KEV.