Vulnerability · Published Sep 24, 2026 · Assigned by VulnCheck

CVE-2026-93354Taskview Community Missing Authentication via OAuth Dynamic Client Registration

High 8.1

In plain English

A high-severity security flaw in taskview-community from Gimanh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data.

Affected products (as reported)

Vendor	Product	Versions
Gimanh	taskview-community	0 – before 1.56.0

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Taskview Community v1.56.0 Release Notes release-notes
https://www.vulncheck.com/advisories/taskview-community-missing-authentication-via-oauth-dynamic-client-registration third-party-advisory