GHSA-4q9j-6299-gxmr: Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Dragonfly Manager versions up to 2.4.3 expose OAuth client secrets via unauthenticated GET endpoints /api/v1/oauth and /api/v1/oauth/:id. These endpoints return the full OAuth configuration including the client_secret field, allowing any network attacker to retrieve sensitive OAuth credentials without authentication. This issue arises because GET handlers lack JWT and RBAC middleware protections that are applied to other HTTP methods in the same route group. The vulnerability affects all versions up to but not including 2.4.4.
AI Analysis
Technical Summary
The Dragonfly Manager's API exposes GET endpoints for OAuth configurations that do not require authentication. These endpoints return the entire OAuth model, including the client_secret field, due to missing JWT and RBAC middleware on the GET methods. This allows unauthenticated attackers to retrieve OAuth client secrets for providers such as GitHub and Google. The issue is present in versions <= 2.4.3 and persists in the main branch at commit 46a8f1e. Other HTTP methods on the same route group are properly protected, but the GET methods were overlooked. The client_secret field is serialized in JSON responses because it lacks a json:"-" tag in the model definition.
Potential Impact
An unauthenticated attacker can retrieve OAuth client secrets configured in the Dragonfly Manager, compromising the confidentiality of these secrets. This exposure can enable attackers to abuse the connected identity providers (GitHub, Google) by impersonating the application or performing unauthorized OAuth flows. The confidentiality breach affects all tenants who have registered OAuth providers. No privilege is required to exploit this vulnerability other than the existence of at least one configured OAuth provider.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Dragonfly Manager API to trusted users only. Avoid exposing the /api/v1/oauth GET endpoints publicly. Monitor vendor communications for updates or patches addressing this issue. Do not rely on the existing JWT and RBAC protections as they do not cover the GET methods for OAuth endpoints.
GHSA-4q9j-6299-gxmr: Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Description
Dragonfly Manager versions up to 2.4.3 expose OAuth client secrets via unauthenticated GET endpoints /api/v1/oauth and /api/v1/oauth/:id. These endpoints return the full OAuth configuration including the client_secret field, allowing any network attacker to retrieve sensitive OAuth credentials without authentication. This issue arises because GET handlers lack JWT and RBAC middleware protections that are applied to other HTTP methods in the same route group. The vulnerability affects all versions up to but not including 2.4.4.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Dragonfly Manager's API exposes GET endpoints for OAuth configurations that do not require authentication. These endpoints return the entire OAuth model, including the client_secret field, due to missing JWT and RBAC middleware on the GET methods. This allows unauthenticated attackers to retrieve OAuth client secrets for providers such as GitHub and Google. The issue is present in versions <= 2.4.3 and persists in the main branch at commit 46a8f1e. Other HTTP methods on the same route group are properly protected, but the GET methods were overlooked. The client_secret field is serialized in JSON responses because it lacks a json:"-" tag in the model definition.
Potential Impact
An unauthenticated attacker can retrieve OAuth client secrets configured in the Dragonfly Manager, compromising the confidentiality of these secrets. This exposure can enable attackers to abuse the connected identity providers (GitHub, Google) by impersonating the application or performing unauthorized OAuth flows. The confidentiality breach affects all tenants who have registered OAuth providers. No privilege is required to exploit this vulnerability other than the existence of at least one configured OAuth provider.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Dragonfly Manager API to trusted users only. Avoid exposing the /api/v1/oauth GET endpoints publicly. Monitor vendor communications for updates or patches addressing this issue. Do not rely on the existing JWT and RBAC protections as they do not cover the GET methods for OAuth endpoints.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4q9j-6299-gxmr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49254"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a46ecba27e9c7971943cd96
Added to database: 07/02/2026, 22:56:58 UTC
Last enriched: 07/02/2026, 23:13:36 UTC
Last updated: 07/03/2026, 03:25:22 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.