-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability centers around missing authorization checks for disabled OAuth2 servers. Based on:
While the exact patch isn't available, these functions represent the most likely locations where authorization checks were either missing (in vulnerable versions) or added (in the patch). The TokenController would handle incoming requests, while ServerInterface would manage server status checks - together forming the authorization boundary that was improperly enforced.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/oauth2_server | composer | < 2.1.0 | 2.1.0 |
Ongoing coverage of React2Shell