—Hex
EEF-CVE-2026-66883· CVE-2026-66883, GHSA-w5r8-m75h-98fcOidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
Modified: 9/8/2026
package
Hex/oidcc_plug
pkg:hex/oidcc_plug
—Hex
EEF-CVE-2026-66884· CVE-2026-66884, GHSA-fg66-w5gp-22crOidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection
Modified: 9/8/2026