---
id: "CVE-2026-63198"
kind: "vulnerability"
aliases: ["CVE-2026-63198"]
title: "traQ: silent OAuth2 consent check lets clients gain broader scopes"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["oauth2", "runtime", "self-hosted", "traq"]
not_affected_if: ["no-oauth-clients", "version-3.28.3-or-later"]
published_at: "2026-11-03T19:18:09+00:00"
first_seen_at: "2026-11-03T19:44:53+00:00"
updated_at: "2026-11-03T19:45:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63198", "first_seen_at": "2026-11-03T19:44:53+00:00"}]
---

# traQ: silent OAuth2 consent check lets clients gain broader scopes

traQ, a messenger application for the traP club, skips scope checks on silent OAuth2 authorization requests (prompt=none with an empty scope), so a malicious OAuth client can get an access token with more scopes than the user consented to. The attacker needs an OAuth client that can receive authorization codes and a user who previously consented to only part of that client's scopes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed traQ version; versions below `3.28.3` are affected.
- Review which OAuth clients are registered with your traQ instance and whether any are untrusted.

## Fix

- traQ: move to `3.28.3` or later.

## Timeline

- 2026-11-03T19:44:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63198

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27
- [fix] Patch: github.com https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
- [fix] Release notes: github.com https://github.com/traPtitech/traQ/releases/tag/v3.28.3

## From the sources

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_