CVE-2026-58422
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in the OAuth sign-in callback mechanism silently re-enables accounts that were disabled by an administrator. Improper authorization allows bypassing administrative account lockout decisions.
Risk Assessment
The organization may lose control over system access, as disabled accounts (e.g., former employees or suspicious users) can be unknowingly restored, increasing the risk of unauthorized access and security breaches.
Recommendation
Immediately update the system to a version containing the fix for the OAuth callback authorization flaw. Until the update is applied, temporarily disable OAuth login or implement additional account validation rules.
Other vulnerabilities in OAuth
See all- CVE-2026-101271Low
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
- CVE-2026-54605High
A vulnerability in the OAuth Ruby library allows an attacker to capture the Authorization header during a redirect. The OAuth::Consumer client follows a 3xx redirect, which can mutate the configuration and expose sensitive data.
- CVE-2026-13707High
Session fixation vulnerability in the Wikimedia Foundation OAuth extension. An attacker can force a victim to use a known session identifier, potentially leading to session hijacking.
Original NVD description (English source)
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Vulnerability data from NVD (NIST) · CISA KEV · EPSS