OAuth

Everything Circuit Observer has reported about OAuth: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

CVSS 9.2: Pingvin Share X OAuth Bug Bypasses TOTP, Lets Hackers Hijack Admin Accounts

A critical authentication bypass in Pingvin Share X allows unauthenticated attackers to hijack accounts, including admin roles, by exploiting a missing email verification check in OAuth flows.

Oct 10, 2026

Vulnerabilities

CVSS 8.1: Vikunja 2.4.0 fixes CVE-2026-57458 OAuth flaw letting scoped API tokens bypass permissions

System administrators must update Vikunja to version 2.4.0 to stop attackers from using limited API tokens to mint unrestricted session credentials.

Oct 10, 2026