Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-93354: Taskview Community allows attackers to hijack user accounts
CVE-2026-93354 · published 2 days ago
Summary
Taskview Community versions before 1.56.0 let anyone register an OAuth client without logging in. This lets a malicious actor create a fake login link, capture the victim’s credentials and gain full access to their data through the API. Updating to version 1.56.0 or later resolves the issue.
What to do
- Update gimanh taskview-community to version 1.56.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gimanh | taskview-community | < 1.56.0 |
Original advisory text
Taskview Community Missing Authentication via OAuth Dynamic Client Registration
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.
References
- https://github.com/Gimanh/taskview-community/releases/tag/v1.56.0 Vendor Advisory
- https://www.vulncheck.com/advisories/taskview-community-missing-authentication-v... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93354... Vendor Advisory
- https://github.com/Gimanh/taskview-community Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-93354 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 8.1 (NVD)
CVSS 4.0: 8.5 (NVD)
Exploitation
EPSS <1%
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published24 Sep 2026
Updated26 Sep 2026
First seen24 Sep 2026
Track software like this
Free during beta