Product

TraQ (< 3.28.3)

2 briefs RSS

traQ: OAuth2 silent authorization bypass (CVE-2026-63198)

The traQ messenger application prior to 3.28.3 fails to validate user consent during OAuth2 silent authorization requests, allowing unauthorized access to broader scopes.

traQ authentication-bypass oauth2 vulnerability

1t 1c 1d ago

high advisory

traQ: Stored cross-site scripting via file upload (CVE-2026-63197)

1 TTP 1 CVE

The traQ messenger application prior to version 3.28.3 is vulnerable to stored cross-site scripting (XSS) when configured with TRAQ_STORAGE_TYPE=local, allowing attackers to upload crafted SVG or HTML files for unauthorized JavaScript execution in a victim's browser.

traQ web-application xss cve-2026-63197

1t 1c 1d ago