CVE-2026-93354: Taskview Community Missing Authentication via OAuth Dynamic Client Registration
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a clientid and clientsecret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Taskview Communityto a version that resolves this vulnerability.Fixed in 1.56.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Taskview Community deployments before 1.56.0 are exposed if their OAuth 2.0 Dynamic Client Registration endpoint is enabled. The endpoint is enabled by default, so default deployments are affected.
What does an attacker need to exploit it?
An attacker needs no authentication or existing account. They can register an OAuth client through a POST request and use an attacker-controlled redirect URI in a malicious authorization link; successful account takeover still requires a victim to interact with that link.
What access can a successful attacker obtain?
The attack can capture authorization codes and exchange them for access tokens with full API access to the victim's account data. This can result in account takeover and compromise of confidentiality and integrity.
What should be done if upgrading is not immediately possible?
Disable the OAuth 2.0 Dynamic Client Registration endpoint if possible, because it is the exposed component used to register arbitrary clients. Upgrade Taskview Community to version 1.56.0 when possible.