CVE-2026-49254

Name of the Vulnerable Software and Affected Versions dragonfly versions prior to 2.4.4

Description The Dragonfly Manager fails to enforce authentication on specific API endpoints, allowing unauthenticated network-reachable attackers to retrieve sensitive OAuth client secrets. The issue occurs because the GET /api/v1/oauth and GET /api/v1/oauth/:id endpoints lack the required JWT and RBAC middleware. Consequently, the response body deserializes the manager/models.Oauth struct, exposing the client secret variable. This leak allows attackers to impersonate the Manager during OAuth handshakes with providers like GitHub or Google, potentially enabling the creation of phishing pages or account-takeover attacks against users relying on OAuth sign-in.

Recommendations Update to a version where the JWT and RBAC middleware are applied at the route-group level for the /oauth endpoints. Mark the ClientSecret field in the Oauth model with json:"-" to prevent it from being serialized in JSON responses. As a temporary workaround, restrict network access to the Manager's REST port (default 8080/tcp) to trusted sources only.