#OAuth2
All CosmicBytez Labs articles tagged #OAuth2, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-103752: Unauthenticated Admin Takeover in the WordPress Authorizer Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress's Authorizer plugin ≤3.15.3 lets attackers become admin via an Azure AD OAuth2 flaw.
- Security
CVE-2026-101090: Nezha Regression Lets Attackers Hijack OAuth2 Logins via Host Header
A patched Nezha flaw returns when dashboard_host is empty — attacker Host headers get reflected into OAuth2 redirect_uri, enabling login hijacking.
- Security
CVE-2026-59354: Spring Security OAuth2 Authorization Server Dynamic Client Registration Flaw
Critical flaw (CVSS 9.6) in Spring Security Authorization Server 7.0.0-7.0.4 lets a registered client trigger stored XSS, SSRF, or privilege escalation.
- Security
Apache CXF OAuth2 Scope Injection Lets Clients Claim Admin Privileges
A critical flaw in Apache CXF's OAuth2 Dynamic Client Registration endpoint stores attacker-supplied scope values verbatim, allowing malicious clients to...
- Security
CVE-2026-9733: Mojolicious OAuth2 Weak PRNG Enables CSRF Session Hijacking
A critical flaw in the Mojolicious::Plugin::Web::Auth::OAuth2 Perl module uses a predictable SHA-1 state derived from epoch time and rand(), allowing...