Oauth
Monthly
Unauthenticated account takeover in the FriendsOfFlarum OAuth extension (fof/oauth) for Flarum, affecting versions prior to 1.7.4 and 2.0.0-beta.4 when the Discord sign-in provider is enabled. Attackers who know a target user's email address can register a Discord account with that address left unverified (relying on a verified phone number to satisfy Discord) and then sign in, causing the extension to hand the address to Flarum core as trusted and link the attacker-controlled Discord identity to the victim's existing account - including administrator accounts - with no password and no victim interaction. The vulnerability has a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is unauthenticated per its vector; no public exploit code identified at time of analysis, though exploitation is straightforward once the preconditions are met.
Reflected JavaScript injection in oauthlib's OAuth 2.0 RevocationEndpoint (CWE-79) lets an attacker who can influence the JSONP `callback` parameter have arbitrary JavaScript echoed back in the response body, but only on authorization servers that explicitly opt in with the non-default `enable_jsonp=True`. Because JSONP executes in the origin of the including page rather than the auth server, the real impact lands on browser-based OAuth clients that consume the endpoint via `<script src>` and where the attacker can control the callback value (query-parameter injection, a reflected value, or a MITM downgrade); this also requires victim user interaction, which is why the practical risk is assessed as conditionally gated rather than a broad emergency. Fixed upstream in oauthlib 4.0.0, which removes JSONP support entirely; no public exploit identified at time of analysis, though the upstream advisory itself ships a proof-of-concept script demonstrating the verbatim reflection.
Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.0%.
Unauthenticated account takeover in the FriendsOfFlarum OAuth extension (fof/oauth) for Flarum, affecting versions prior to 1.7.4 and 2.0.0-beta.4 when the Discord sign-in provider is enabled. Attackers who know a target user's email address can register a Discord account with that address left unverified (relying on a verified phone number to satisfy Discord) and then sign in, causing the extension to hand the address to Flarum core as trusted and link the attacker-controlled Discord identity to the victim's existing account - including administrator accounts - with no password and no victim interaction. The vulnerability has a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is unauthenticated per its vector; no public exploit code identified at time of analysis, though exploitation is straightforward once the preconditions are met.
Reflected JavaScript injection in oauthlib's OAuth 2.0 RevocationEndpoint (CWE-79) lets an attacker who can influence the JSONP `callback` parameter have arbitrary JavaScript echoed back in the response body, but only on authorization servers that explicitly opt in with the non-default `enable_jsonp=True`. Because JSONP executes in the origin of the including page rather than the auth server, the real impact lands on browser-based OAuth clients that consume the endpoint via `<script src>` and where the attacker can control the callback value (query-parameter injection, a reflected value, or a MITM downgrade); this also requires victim user interaction, which is why the practical risk is assessed as conditionally gated rather than a broad emergency. Fixed upstream in oauthlib 4.0.0, which removes JSONP support entirely; no public exploit identified at time of analysis, though the upstream advisory itself ships a proof-of-concept script demonstrating the verbatim reflection.
Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 29.0%.