Alertas de Seguridad de la Información

M Crítico vulnerabilidad Nuevo

Hace 5 min

[CVE-2026-108261] Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /…

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the Graph…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101152] Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated…

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-101090] Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the ne…

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to b…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-54618] Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize…

Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-54072] Authorizer is an open-source, self-hostable authentication and authorization server. Prior to versio…

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or `response_type=id_token`, the server appends `access_token`, `id_token`, and `refresh_token` as query parameters and issues a 302 redirect to the attacker-suppl…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88887] Renovate is a dependency update automation tool. When listing tags/digests for a container image, Re…

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry. A malicious or compromised container registry can therefore s…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88880] Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagi…

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88881] Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HT…

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromis…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88882] Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE…

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by the registry in the HTTP `Link` header without verifying that the target has the same origin as the c…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

10/09/2026

Vulnerabilidad de redirección abierta (Open Redirect) en Access Control System de Armiya

Se ha identificado una vulnerabilidad de redirección abierta en Access Control System de Armiya Information Technologies (versiones anteriores a la 2.0) que permite a atacantes redirigir usuarios a sitios no confiables y falsificar la fuente de datos. Esta falla afecta principalmente sistemas de control de acceso implementados en instalaciones de seguridad física en México y Latinoamérica, exponiendo credenciales y sesiones de usuarios autorizados.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-53728] Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6,…

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attack…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81036] Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in…

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a regi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81029] OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued to…

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer servlet later formats that stored value into a URL carrying the freshly issued JWT together with the ac…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79786] Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically va…

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta en Ech0 ≤4.5.6: validación insuficiente en redirección OAuth

Ech0 versiones hasta 4.5.6 presenta una vulnerabilidad en la validación de redirect_uri OAuth que solo verifica esquema y host, ignorando ruta, parámetros y fragmentos. Esto permite a atacantes redirigir tokens de autenticación a dominios controlados después de pasar la validación inicial. Empresas en LATAM que usan Ech0 para autenticación federada enfrentan riesgo alta de compromiso de sesiones y acceso no autorizado a sistemas integrados.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-71428] The unstructured library provides open-source components for ingesting and pre-processing images and…

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58230] SAP Approuter does not sufficiently validate certain token content under specific configurations. An…

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2025-71403] better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic…

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-10545] IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an a…

IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54603] OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connec…

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request authority, so the bearer Authorization header is sent to an attacker-controlled host, leaking the credential. This issue is fixed in version 2.0.22.

nvdaltovulnerabilidad CVSS 8.6 NVD