P4Verified

CVE-2026-93354: taskview-community 0 to before 1.56.0

CVE-2026-93354. CVSS 3.1 base score 8.1 (HIGH, Vendor/CNA). EPSS 0.00265 (percentile 0.16755), scored 05-Oct-2026. Fixed version: a8dfa8c9731d422a189b5b3c408f41a7e6c05823.

Affected technology

taskview-community · 0 to before 1.56.0
Gimanh

Description’s affected range: before 1.56.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Unauthenticated attackers can register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 12-Oct-2026 00:35 UTC

CWE: CWE-1188
CCR priority: 32.5 /100 (P4)
CVSS 3.1: 8.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · Vendor/CNA
EPSS: 0.00265 · percentile 0.16989 · 2026-10-11
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-05 23:09:08.830529+00:00 UTC
OSV.dev · Source record · observed 2026-10-07 03:19:31.921362+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-93354.html