CVE-2026-93354 Details

A missing authentication vulnerability has been identified in Taskview Community versions prior to 1.56.0. This vulnerability allows unauthenticated attackers to register arbitrary OAuth clients by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret. They can then create a malicious authorization link that includes an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens, granting full API access to the victim's account data.