Monthly
OAuth authorization code hijacking in Stalwart Mail Server through v0.16.19 enables full email account takeover when a victim authenticates via a crafted phishing link. The validation routine for OAuth redirect URIs in the default shipped configuration - where client authentication is disabled - returns success immediately without comparing the supplied redirect_uri against any registered client destination, allowing any attacker-controlled URI to receive a valid authorization code. The CVSS 4.0 score of 8.5 with high confidentiality and integrity impact reflects the severity of resulting mailbox compromise; no public exploit code has been identified at time of analysis, though the vulnerability is fully described in a public GitHub issue with source-level detail.
JWT token disclosure in OpenMetadata's SAML and OIDC/OAuth2 authentication flows enables account takeover by exploiting an unvalidated open redirect that appends the victim's freshly issued JWT, email, and account name to an attacker-controlled URL. All 1.x releases are affected because neither SamlLoginServlet nor the OIDC/OAuth2 handler validates the caller-supplied redirect destination against any allowlist or registered callback set. An attacker who socially engineers a victim into clicking a crafted login URL can capture the full JWT upon successful authentication and immediately assume control of that account via the OpenMetadata API. No public exploit has been identified at time of analysis, and no CISA KEV listing is confirmed.
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.
Server-side request forgery in the Unstructured-IO `unstructured` library (0.4.7 through versions before 0.24.0) lets an attacker who controls the `url=` argument of partition(), partition_html(), or partition_md() coerce a server-side ingestion service into fetching loopback, internal, or cloud-metadata endpoints, with the response returned as Element text. Because ingestion pipelines commonly accept user-supplied URLs, unauthenticated remote abuse is realistic (CVSS 9.3). No public exploit identified at time of analysis; the flaw is fixed in 0.24.0 via a centralized fetch helper.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
OAuth authorization code hijacking in Stalwart Mail Server through v0.16.19 enables full email account takeover when a victim authenticates via a crafted phishing link. The validation routine for OAuth redirect URIs in the default shipped configuration - where client authentication is disabled - returns success immediately without comparing the supplied redirect_uri against any registered client destination, allowing any attacker-controlled URI to receive a valid authorization code. The CVSS 4.0 score of 8.5 with high confidentiality and integrity impact reflects the severity of resulting mailbox compromise; no public exploit code has been identified at time of analysis, though the vulnerability is fully described in a public GitHub issue with source-level detail.
JWT token disclosure in OpenMetadata's SAML and OIDC/OAuth2 authentication flows enables account takeover by exploiting an unvalidated open redirect that appends the victim's freshly issued JWT, email, and account name to an attacker-controlled URL. All 1.x releases are affected because neither SamlLoginServlet nor the OIDC/OAuth2 handler validates the caller-supplied redirect destination against any allowlist or registered callback set. An attacker who socially engineers a victim into clicking a crafted login URL can capture the full JWT upon successful authentication and immediately assume control of that account via the OpenMetadata API. No public exploit has been identified at time of analysis, and no CISA KEV listing is confirmed.
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.
Server-side request forgery in the Unstructured-IO `unstructured` library (0.4.7 through versions before 0.24.0) lets an attacker who controls the `url=` argument of partition(), partition_html(), or partition_md() coerce a server-side ingestion service into fetching loopback, internal, or cloud-metadata endpoints, with the response returned as Element text. Because ingestion pipelines commonly accept user-supplied URLs, unauthenticated remote abuse is realistic (CVSS 9.3). No public exploit identified at time of analysis; the flaw is fixed in 0.24.0 via a centralized fetch helper.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.