Live › vulnerability › CVE-2026-63198
traQ, a messenger application for the traP club, skips scope checks on silent OAuth2 authorization requests (prompt=none with an empty scope), so a malicious OAuth client can get an access token with more scopes than the user consented to. The attacker needs an OAuth client that can receive authorization codes and a user who previously consented to only part of that client's scopes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Self-hosted traQ instances running a version before 3.28.3 that have OAuth2 clients registered. Exposure depends on whether an attacker can register or control an OAuth client that receives authorization codes; instances without third-party OAuth clients are less exposed.
No product ranges from the sources yet.
3.28.3 are affected.3.28.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-63198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.