Threats tagged 'ghsa-46mx-9v73-g459'

Concrete CMS versions 8.5.3 through 9.5.2 use an unmodified OAuth 2.0 refresh-token grant implementation that does not verify if an account is active when issuing new access tokens. This allows a user with a valid refresh token obtained while active to continue generating access tokens even after their account is deactivated or suspended, effectively bypassing account deactivation for API access. The vulnerability has a low CVSS v4.0 score of 2.3.