CVE-2026-63198

Name of the Vulnerable Software and Affected Versions traQ versions prior to 3.28.3

Description OAuth2 silent authorization requests using the prompt=none parameter with an empty or omitted scope parameter check prior consent against an empty requested scope set, despite all scopes registered for the client becoming eligible for issuance. This allows an attacker controlling an OAuth client to target users who previously consented to only a limited set of scopes and obtain an access token with broader registered scopes without requiring additional consent.

Recommendations Update traQ to version 3.28.3.