traQ: Privilege escalation by OAuth prompt=none request
Only traQ instances with OAuth clients that use silent authorization (prompt=none) with an empty or omitted scope are affected. The fix is in 3.28.3.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.28.3
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. OAuth2 silent authorization (prompt=none) with an empty or omitted scope parameter The user has previously consented to only a subset of the client's scopes
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.28.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
traQ, a messenger application used by the Digital Creators Club traP, is affected by a flaw in its OAuth2 silent authorization handling that lets an attacker obtain access tokens with broader permissions than the user approved. Exploiting it requires an attacker-controlled OAuth client, and the result is that a user's access token can include more scopes than they consented to.
Read the original description
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.
What to do
Check whether your setup matches what the bug needs.
OAuth2 silent authorization (prompt=none) with an empty or omitted scope parameter The user has previously consented to only a subset of the client's scopesUpgrade to a fixed version: 3.28.3.
Workaround: Reject authorization requests with prompt=none where scope is empty or omitted
Timeline
- CVE published
- First seen by cve.now
Affected versions
- traPtitech traQ
fixed in 3.28.3
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-63198
What does this mean?
When a silent OAuth authorization request (prompt=none) left the scope empty or omitted, traQ issued a token with every scope registered for the client, even if the user had consented to only some of them. An attacker controlling an OAuth client could obtain that broader token without new consent.Source: github.com
Am I affected, and how do I check?
Versions before 3.28.3 are affected when OAuth2 silent authorization (prompt=none) is used with an empty or omitted scope parameter, and the user has consented to only a subset of the client's scopes. Check the installed traQ version against 3.28.3 to see whether it predates the fix.Source: github.com
What should I do about it?
Upgrade traQ to 3.28.3, which the advisory says fixes this issue. Until then, the workaround is to reject authorization requests with prompt=none where scope is empty or omitted.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data