traQ OAuth silent authorization grants broader scopes
Messenger accounts can have extra permissions taken by attackers.
Summary
A flaw in how traQ handles OAuth silent authorization requests lets a malicious OAuth client get an access token with broader scopes than the user approved. Users who consented only to some client scopes are affected.
Affected when
- traQ before 3.28.3
- User consented to only some scopes of an OAuth client
What to do
Update to traQ 3.28.3 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen