Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-53552

  CVE-2026-53552: Goploy Cross-Namespace IDOR and RCE via Body-Controlled Project ID

  A manager in any Goploy namespace can read, overwrite, or delete project files owned by other namespaces, and rewrite a foreign project's git remote URL to trigger remote code execution on the next…

• highCVE-2026-53553

  CVE-2026-53553: Goploy Arbitrary File Read via Path Traversal in /deploy/fileDiff

  Any low-privileged Goploy user can read arbitrary files on both the Goploy server and every remote server it manages by sending a crafted file path to the file-comparison API.

• highCVE-2026-53514

  CVE-2026-53514: better-auth Organization Invitation Takeover via Unverified Email Pre-Registration

  An attacker who registers an account using a victim's email address (without verifying it) can accept organization invitations meant for that victim, joining the organization at whatever role the…

• highCVE-2026-53516

  CVE-2026-53516: better-auth OAuth Auto-Link Account Takeover via Unverified Email

  An attacker can pre-register a victim's email address to hijack their account when the victim later signs in with OAuth, because better-auth blindly trusts the OAuth provider's email-verified claim…

• high

  better-auth Stored XSS via javascript: redirect_uri in oidc-provider and mcp Plugins

  The better-auth oidc-provider and mcp plugins accept any string as an OAuth redirect URI, letting an attacker store a javascript: URL that executes in the authorization server's origin when a victim…

• highCVE-2026-53517

  CVE-2026-53517: @better-auth/oauth-provider Refresh Token Family Fork via Race Condition

  A race condition in the OAuth provider's token endpoint lets two concurrent requests redeem the same refresh token before either revocation is written, forking the token family and granting…

• criticalCVE-2026-53513

  CVE-2026-53513: @better-auth/sso SSRF via Unvalidated OIDC Endpoints

  Any authenticated user can register a fake SSO provider pointing OIDC endpoints at internal addresses, causing the auth server to fetch and reflect responses from cloud metadata services, localhost…

• highCVE-2026-53518

  CVE-2026-53518: @better-auth/oauth-provider Authorization Code Race Condition Allows Duplicate Token Issuance

  A race condition in the OAuth authorization-code token endpoint lets two concurrent requests redeem the same single-use code simultaneously, each receiving valid but independent access, refresh, and…

• high

  @better-auth/scim: SCIM Provider Account Takeover via Missing Owner Binding

  Any authenticated user can hijack another user's SCIM directory connection by calling the token-regeneration endpoint with a known provider ID, invalidating the legitimate bearer token and gaining…

• criticalCVE-2026-27823

  CVE-2026-27823: EGroupware SmallPART Remote Code Execution via Auth Bypass and Path Traversal

  A critical chain of three bugs in EGroupware lets an attacker bypass teacher authorization, overwrite the PHP configuration file with malicious code, and achieve remote code execution on the server.

• highCVE-2026-33655

  CVE-2026-33655: new-api SSRF Protection Bypass via Unresolved Hostname

  Authenticated users of new-api could point Webhook, Bark, or Gotify notification URLs at a hostname that resolves to an internal or cloud-metadata IP address, causing the server to make requests to…

• highCVE-2026-34151

  CVE-2026-34151: XWiki Platform Old Core Path Traversal via /skin/ Endpoint on Jetty 12

  A double-percent-encoded path in XWiki's /skin/ action lets any unauthenticated user read arbitrary files from the server filesystem, including /etc/passwd and WEB-INF config files, when running on…