CVE-2026-108865

{
  "etk_id": "ETK-2026-1250",
  "cve_id": "CVE-2026-108865",
  "display_id": "CVE-2026-108865",
  "ghsa_id": "GHSA-pfxh-9349-4f24",
  "euvd_id": "EUVD-2026-97016",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth2 authentication bypass in AmoyLab Unla",
  "summary": "AmoyLab Unla versions through 0.10.0 allow OAuth2 tokens to be issued without validating the resource owner. An unauthenticated attacker may use those tokens to reach protected MCP routes, proxied upstream services, or injected credentials when they can access the OAuth2 service and register a client.",
  "mitigation": "Disable public access to the OAuth2 authorization and token endpoints, or restrict them to trusted users and networks, until a corrected release is available. Limit client registration and review access to services and credentials exposed through Unla.",
  "vendor": "AmoyLab",
  "product": "Unla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.10.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Unla",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0032,
  "epss_percentile": 0.2398,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.444879666666665,
  "t0_at": "2026-10-11T13:26:10.714000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-11T13:26:10.714000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-11T13:26:10.714000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108865"
    }
  }
}