Vendor
The traQ messenger application prior to 3.28.3 fails to validate user consent during OAuth2 silent authorization requests, allowing unauthorized access to broader scopes.