Taskview Community Missing Authentication via OAuth Dynamic Client Registration
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.
CVE-2026-93354
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93354
taskview-community
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/Gimanh/taskview-community",
"vendor": "Gimanh",
"product": "taskview-community",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.56.0",
"versionType": "semver"
}
],
"packageURL": "pkg:github/Gimanh/taskview-community",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-93354
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8955 · Revision 1
- Added to Heist Feed
- Publisher date