CVE-2024-11217
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.
Risk Assessment
Exposure of client secrets may allow an attacker to impersonate the application and take over user sessions.
Recommendation
It is recommended to set the log level below Debug in production environments and regularly review logs for secret leaks.
Other vulnerabilities in OAuth-server
See all- CVE-2026-97288Medium
The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
- CVE-2026-19078Medium
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website, enabling phishing attacks.
Original NVD description (English source)
A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS