CVE-2026-29782

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

• CWE-502

• https://github.com/devcode-it/openstamanager/commit/d2e38cbdf91a831cefc0da1548e02b297ae644ccPatch
• https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2Product, Release Notes
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-whv5-4q2f-q68gExploit, Mitigation, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29777Traefik is an HTTP reverse proxy and load balancer. Prior to…6.5
• CVE-2026-29778pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-29779UptimeFlare is a serverless uptime monitoring & status page …7.5
• CVE-2026-2978A vulnerability was detected in FastApiAdmin up to 2.2.0. Th…8.8
• CVE-2026-29780eml_parser serves as a python module for parsing eml files a…5.5
• CVE-2026-29781Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-29783The shell tool within GitHub Copilot CLI versions prior to a…7.8
• CVE-2026-29784Ghost is a Node.js content management system. From version 5…8.8
• CVE-2026-29785NATS-Server is a High-Performance server for NATS.io, a clou…7.5
• CVE-2026-29786node-tar is a full-featured Tar for Node.js. Prior to versio…6.3
• CVE-2026-29787mcp-memory-service is an open-source memory backend for mult…5.3
• CVE-2026-29788TSPortal is the WikiTide Foundation’s in-house platform used…7.5