{"id":"CVE-2026-63198","aliases":["GHSA-8cfq-jgf7-8m27"],"url":"https://o3.security/vulnerability/CVE-2026-63198","summary":"traQ: Privilege escalation by OAuth prompt=none request","details":"In OAuth2 silent authorization (`prompt=none`), when the `scope` parameter was empty or omitted, all scopes registered for the OAuth client became eligible for issuance. However, the prior consent check was performed against the empty requested scope set. As a result, an attacker could obtain an access token with broader scopes than the user had previously consented to, without requiring additional consent.\n\n## Impact\n\nIf an attacker controls an OAuth client capable of receiving authorization codes, and a user has already consented to only a subset of that client’s scopes, the attacker may be able to obtain a token containing all scopes registered for that client by sending an authorization request with `prompt=none` and an empty or omitted `scope`.\n\nIf the user has not consented to the client at all, `consent_required` is returned as usual.\n\n## Patches\n\nThis issue has been fixed in v3.28.3. After the fix, the consent check for `prompt=none` verifies the scopes that will actually be issued, rather than the empty requested scope set. If the user has not consented to all scopes after expansion, `consent_required` is returned.\n\ntraQ also recommends revoking any existing OAuth tokens created before the fix if they were potentially affected.\n\n## Workarounds\n\nIf users cannot update immediately, they should apply the following mitigations:\n\n- Disable untrusted OAuth clients, minimize registered client scopes, and revoke existing tokens\n- Reject authorization requests with `prompt=none` where `scope` is empty or omitted","published":"2026-11-03T18:38:35.870Z","modified":"2026-11-05T03:30:14.111330994Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/traPtitech/traQ","fixedVersion":"1.0.0-rc.2.0.20260629134940-5510fe8aa9bb"}],"fix":{"url":"https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3","label":"traPtitech/traQ@5510fe8"},"references":[{"type":"WEB","url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63198.json"},{"type":"ADVISORY","url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63198"},{"type":"FIX","url":"https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3"},{"type":"PACKAGE","url":"https://github.com/traPtitech/traQ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:30:14.111330994Z"}}