GHSA-f54h-78c9-c24h
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 9.5.1 | 9.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.
References
External links from the advisory. They lead to third-party sites.