EUVD-2026-116132Published
traQ: Privilege escalation by OAuth prompt=none request
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-63198 · CVE overview and exploitation status
cve-program · CVE-2026-63198
- https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27
- https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
- https://github.com/traPtitech/traQ/releases/tag/v3.28.3
euvd · EUVD-2026-116132
- https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27
- https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
- https://github.com/traPtitech/traQ/releases/tag/v3.28.3
nvd · CVE-2026-63198
- https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
- https://github.com/traPtitech/traQ/releases/tag/v3.28.3
- https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27
osv · GHSA-8cfq-jgf7-8m27
Related changes
Linked by CVE identifier- traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set… · Advisory content revised · 13 Nov 2026
- traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set… · Advisory content revised · 11 Nov 2026
- traQ: Privilege escalation by OAuth prompt=none request · Newly collected advisory · 9 Nov 2026
- traQ: Privilege escalation by OAuth prompt=none request · Newly collected advisory · 3 Nov 2026