EUVD-2026-86453
GHSA-2hxj-r43h-qh98
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network registration (PR:N/AV:N/AC:L) but victim must click and approve the malicious authorization link (UI:R); token grants full read/write API access (C:H/I:H), no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.
AnalysisAI
Taskview Community before 1.56.0 ships its OAuth 2.0 Dynamic Client Registration endpoint enabled by default and reachable without authentication, letting any remote unauthenticated attacker register a rogue OAuth client and obtain a working client_id and client_secret. The attacker then distributes a crafted authorization link that redirects to an attacker-controlled URI, and once the victim approves the consent screen the captured authorization code is exchanged for an access token granting full API access to that victim's account data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the OAuth 2.0/2.1 Dynamic Client Registration endpoint to be reachable and open - in versions before 1.56.0 the description states this is enabled by default and needs no authentication (the OAUTH_DYNAMIC_REGISTRATION toggle documented in v1.56.0 makes it off-by-default in the fixed release, so verify the default for your affected version). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority account-takeover flaw despite carrying no active-exploitation signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: v1.56.0 - upgrade Taskview Community to 1.56.0 or later using the release at https://github.com/Gimanh/taskview-community/releases/tag/v1.56.0, and leave OAUTH_DYNAMIC_REGISTRATION unset or false unless you deliberately need AI/MCP clients to self-register. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Taskview Community instance in the estate and confirm which run versions earlier than 1.56.0; where the platform permits, disable the OAuth 2.0 Dynamic Client Registration endpoint, or otherwise network-isolate and remove it from public reachability via an identity-aware proxy, WAF rule, or reverse-proxy allowlist, and at the same time review all existing OAuth client registrations and user consent grants for anything unrecognized and revoke what cannot be accounted for. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today