Do Son Two critical RabbitMQ flaws allow authentication bypass. One forges TLS client certs; the other tricks OAuth2 JWKS to accept any JWT.
OAuth2
Laravel Passport patches a 7.1 CVSS authentication bypass where machine tokens masquerade as human users. Protect your app—upgrade to v13.7.1 now!
OpenStack patches CVE-2026-22797 (Privilege Escalation). Flaw in OAuth2 middleware allows header forgery for admin access. Update keystonemiddleware now.
A critical vulnerability (CVE-2025-54576, CVSS 9.1) in OAuth2-Proxy allows attackers to bypass authentication by manipulating query parameters that match skip_auth_routes regex patterns.
A flaw (CVE-2025-43856) in Immich allows account hijacking via a broken OAuth2 implementation (missing state parameter check). Update to v1.132.0 immediately!
Amazon Redshift Python Connector has a high severity vulnerability allowing OAuth2 token interception due to missing SSL validation.