CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.

• CWE-330
• CWE-330

• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Aug/8Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdfRelease Notes
• http://packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Aug/8Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0003.json
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6230_7.10.6_2023-05-02.pdfRelease Notes

Published

Aug 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26446The users clientID at "application passwords" was not saniti…5.4
• CVE-2023-26447The "upsell" widget for the portal allows to specify a produ…5.4
• CVE-2023-26448Custom log-in and log-out locations are used-defined as jslo…5.4
• CVE-2023-26449The "OX Chat" web service did not specify a media-type when …5.4
• CVE-2023-2645A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-26450The "OX Count" web service did not specify a media-type when…5.4
• CVE-2023-26452Requests to cache an image and return its metadata could be …8.8
• CVE-2023-26453Requests to cache an image could be abused to include SQL qu…8.8
• CVE-2023-26454Requests to fetch image metadata could be abused to include …8.8
• CVE-2023-26455RMI was not requiring authentication when calling ChronosRMI…7.8
• CVE-2023-26456Users were able to set an arbitrary "product name" for OX Gu…5.4
• CVE-2023-26457SAP Content Server - version 7.53, does not sufficiently enc…6.1