CVE-2026-63198

The record

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

Affected packages

Related vulnerabilities

• CVE-2026-116667 Tanium addressed an improper access controls vulnerability in Discover. CWE-863
• CVE-2026-116661 Tanium addressed an improper access controls vulnerability in Enforce. CWE-863
• CVE-2026-116664 Tanium addressed an improper access controls vulnerability in Discover. CWE-863
• CVE-2026-121541 In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that… CWE-863
• CVE-2026-120930 Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote… CWE-863
• CVE-2026-95860 node-opcua is an OPC UA implementation for TypeScript and Node.js. CWE-863
• CVE-2026-121255 Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a… CWE-863
• CVE-2026-121248 Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-863