{"id":"CVE-2026-63198","kind":"vulnerability","aliases":["CVE-2026-63198"],"related":[],"title":"traQ: silent OAuth2 consent check lets clients gain broader scopes","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.","summary":"traQ, a messenger application for the traP club, skips scope checks on silent OAuth2 authorization requests (prompt=none with an empty scope), so a malicious OAuth client can get an access token with more scopes than the user consented to. The attacker needs an OAuth client that can receive authorization codes and a user who previously consented to only part of that client's scopes.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oauth2","runtime","self-hosted","traq"],"not_affected_if":["no-oauth-clients","version-3.28.3-or-later"],"how_to_check":"- Check the installed traQ version; versions below `3.28.3` are affected.\n- Review which OAuth clients are registered with your traQ instance and whether any are untrusted.","fix":"- traQ: move to `3.28.3` or later.","status":"open","published_at":"2026-11-03T19:18:09+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","triaged_at":"2026-11-03T19:45:33+00:00","updated_at":"2026-11-03T19:45:33+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T19:45:33Z","model":"claude-haiku-5-5","output":{"fix":"- traQ: move to `3.28.3` or later.","reach":"internet","title":"traQ: silent OAuth2 consent check lets clients gain broader scopes","impact":"medium","summary":"traQ, a messenger application for the traP club, skips scope checks on silent OAuth2 authorization requests (prompt=none with an empty scope), so a malicious OAuth client can get an access token with more scopes than the user consented to. The attacker needs an OAuth client that can receive authorization codes and a user who previously consented to only part of that client's scopes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traq","oauth2","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker obtains access token with broader scopes than consented","analyst_note":"","how_to_check":"- Check the installed traQ version; versions below `3.28.3` are affected.\n- Review which OAuth clients are registered with your traQ instance and whether any are untrusted.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.28.3-or-later","no-oauth-clients"],"who_is_affected":"Self-hosted traQ instances running a version before 3.28.3 that have OAuth2 clients registered. Exposure depends on whether an attacker can register or control an OAuth client that receives authorization codes; instances without third-party OAuth clients are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4245,"output_tokens":535,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-63198':13A,16A '3.28.3':101C,192C 'access':53B,164C 'addit':171C 'applic':26B,92C 'attack':64B,138C 'author':37B,72B,104C,147C 'becom':133C 'broader':9A,167C 'built':93C 'capabl':144C 'check':5A,33B,116C 'client':7A,49B,68B,85B,132C,143C,159C,181C 'club':30B,97C 'code':73B,148C 'consent':4A,61B,79B,118C,155C,172C,178C,184C 'contain':166C 'control':140C 'creator':96C 'cve':11A,14A 'digit':95C 'elig':134C 'empti':43B,111C,121C 'even':125C 'fix':189C 'gain':8A 'get':51B 'host':21B 'issu':187C 'issuanc':136C 'let':6A 'malici':47B 'messeng':25B,91C 'need':65B 'never':177C 'none':40B,108C 'oauth':48B,67B,142C 'oauth2':3A,17B,36B,102C 'obtain':162C 'omit':113C 'paramet':115C 'part':82B 'previous':78B,154C 'prior':99C,117C 'prompt':39B,107C 'receiv':71B,146C,183C 'regist':129C,168C 'request':38B,105C,122C 'requir':185C 'runtim':18B 'scope':10A,32B,44B,57B,87B,114C,123C,128C,160C,169C 'self':20B 'self-host':19B 'set':124C 'silent':2A,35B,103C 'skip':31B 'still':182C 'target':150C 'though':126C 'token':54B,165C 'trap':29B,98C 'traq':1A,22B,23B,88C 'use':106C 'user':60B,76B,152C,174C 'version':191C 'without':170C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted traQ instances running a version before 3.28.3 that have OAuth2 clients registered. Exposure depends on whether an attacker can register or control an OAuth client that receives authorization codes; instances without third-party OAuth clients are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","oauth2","runtime","selfhosted","traq"],"campaign_type":null,"first_public_at":"2026-07-01T11:20:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63198","severity":null,"published_at":"2026-11-03T19:18:09+00:00","modified_at":"2026-11-03T19:18:09+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","fetched_at":"2026-11-03T19:44:53+00:00","note":null}],"documents":[{"id":60207,"url":"https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60205,"url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60209,"url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:20:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}