CVE-2026-97288
MediumCVSS 6.5Summary
The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
Risk Assessment
A low-privileged user can execute malicious code in other users' browsers, potentially leading to session data theft or content modification.
Recommendation
Update the OAuth Server plugin to a version later than 4.5.1 to remove the XSS vulnerability.
Other vulnerabilities in OAuth Server
See all- CVE-2026-19078Medium
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website, enabling phishing attacks.
- CVE-2024-11217Medium
A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS