Digital Creators Club TraP - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/digital-creators-club-trap/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:04:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgtraQ: OAuth2 silent authorization bypass (CVE-2026-63198)https://feed.craftedsignal.io/briefs/2026-11-traq-oauth-bypass/Tue, 03 Nov 2026 20:04:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-traq-oauth-bypass/The traQ messenger application prior to 3.28.3 fails to validate user consent during OAuth2 silent authorization requests, allowing unauthorized access to broader scopes.The traQ messenger application (versions prior to 3.28.3) contains an authentication flaw in its OAuth2 implementation. When a silent authorization request (prompt=none) is made with an empty or omitted scope parameter, the application erroneously checks consent against an empty set, effectively bypassing existing restrictions. An attacker controlling an OAuth client can obtain an access token with broader registered scopes than what the user previously approved, provided the user had at least one prior consent entry for that client.

Impact

Successful exploitation allows an attacker to escalate privileges within the application by obtaining access tokens with excessive permissions without further user interaction.

Recommendation

  • Upgrade the traQ messenger application to version 3.28.3 or later immediately.
  • Review OAuth client registrations and audit application access tokens for unexpected scope assignments for users who have interacted with third-party or untrusted OAuth clients.
]]>highadvisoryauthentication-bypassoauth2vulnerability