{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/taskview/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:taskview:taskview_community:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-93354"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Taskview Community (\u003c 1.56.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Taskview"],"content_html":"\u003cp\u003eTaskview Community versions prior to 1.56.0 contain a critical vulnerability in the OAuth 2.0 Dynamic Client Registration endpoint that permits unauthenticated access. By default, this endpoint is active and lacks any form of identity verification, enabling any actor on the network to register an arbitrary OAuth client. An attacker can leverage this to register their own client application, receive valid credentials (client_id and client_secret), and initiate malicious OAuth flows. This vulnerability poses a significant risk to the integrity of user accounts within affected Taskview deployments, as it facilitates full unauthorized access to API data and account information. Defending against this requires immediate patching or, as a temporary measure, ensuring that the Dynamic Client Registration endpoint is explicitly disabled or restricted to trusted internal network ranges if the business logic allows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to hijack user sessions and gain full API access to sensitive victim account data. Organizations utilizing Taskview Community to manage OAuth workflows are at high risk of large-scale account takeover events and data exfiltration through the application's API layer.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Taskview Community to version 1.56.0 or later immediately to address the missing authentication in the OAuth registration endpoint.\u003c/li\u003e\n\u003cli\u003eAudit logs for the OAuth 2.0 Dynamic Client Registration endpoint to identify any unauthorized or unexpected client registration requests originating from outside authorized administrative subnets.\u003c/li\u003e\n\u003cli\u003eReview all registered OAuth clients for unrecognized or suspicious entries that may have been created by unauthorized actors during the exposure period.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-24T20:47:41Z","date_published":"2026-09-24T20:47:41Z","id":"https://feed.craftedsignal.io/briefs/2026-09-taskview-auth-bypass/","summary":"Taskview Community versions before 1.56.0 are vulnerable to an authentication bypass in the OAuth 2.0 Dynamic Client Registration endpoint, allowing unauthenticated attackers to register clients and hijack user accounts.","title":"Unauthenticated Account Takeover in Taskview Community via OAuth Dynamic Registration","url":"https://feed.craftedsignal.io/briefs/2026-09-taskview-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Taskview","version":"https://jsonfeed.org/version/1.1"}