CVE-2026-49254

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go returns models.Oauth records and manager/models/oauth.go exposes Oauth.ClientSecret as client_secret in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can reach GetOauth or GetOauths, load the stored models.Oauth record, and obtain the provider's client secret, client identifier, and redirect URL. The earlier GHSA-j8hf-cp34-g4j7 remediation protected the /jobs group only and did not protect these OAuth GET handlers. Disclosure of client_secret can enable abuse of the configured identity-provider integration, subject to the provider's redirect URI restrictions. This issue is fixed in 2.4.4.

• CWE-200
• CWE-306

• https://github.com/dragonflyoss/dragonfly/commit/20cb2f9cb6372d13c029779f427bdb5ede111183
• https://github.com/dragonflyoss/dragonfly/releases/tag/v2.4.4
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4q9j-6299-gxmr

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49248OneDev is a Git server with CI/CD, kanban, and packages. In …8.3
• CVE-2026-49249Boruta is a standalone authorization server that aims to imp…7.1
• CVE-2026-4925Improper access control in the users MFA feature in Devoluti…5
• CVE-2026-49250Conform, a type-safe form validation library, allows the par…8.7
• CVE-2026-49252deepstream is a server that allows clients and backend servi…9.9
• CVE-2026-49253electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.1
• CVE-2026-49255electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…8.8
• CVE-2026-49256Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-49257mcp-pinot is a Python-based Model Context Protocol (MCP) ser…10
• CVE-2026-49258Nebula Mesh is a self-hosted control plane for the Slack Neb…8.8
• CVE-2026-4926Impact: A bad regular expression is generated any time you …7.5
• CVE-2026-49260PhpWeasyPrint is a PHP library allowing PDF generation from …8.2