Vulnerability Description
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Gimanh/taskview-community/releases/tag/v1.56.0
- https://www.vulncheck.com/advisories/taskview-community-missing-authentication-v
FAQ
What is CVE-2026-93354?
CVE-2026-93354 is a vulnerability with a CVSS score of 8.1 (HIGH). Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the...
How severe is CVE-2026-93354?
CVE-2026-93354 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93354?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.