CVE-2022-3926

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-392608.8Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement CVE-2022-392617.5Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the fCVE-2022-392624.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can defCVE-2022-392638.1`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications thaCVE-2022-392645.9nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting maliciousCVE-2022-392657.2MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters settingCVE-2022-392669.8isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 CVE-2022-392678.8Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for productioCVE-2022-392688.1### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This mayCVE-2022-392699.1PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switchCVE-2022-39279.8The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification.CVE-2022-392705.4DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categorie