CVE-2026-63198: OAuth 2.0 Silent Authorization Scope Escalation in traQ

Vulnerability ID: CVE-2026-63198
CVSS Score: 7.3
Published: 2026-11-09

CVE-2026-63198 (GHSA-8cfq-jgf7-8m27) is an incorrect authorization vulnerability (CWE-863) in traQ, an open-source messaging platform developed in Go by Digital Creators Club traP. The flaw resides in the OAuth 2.0 authorization endpoint handler (router/oauth2/authorization_endpoint.go). When processing silent authorization requests (prompt=none) with an omitted or empty scope parameter, the application evaluates prior user consent against the empty requested scope set prior to applying default scope fallback logic. Because an empty set vacuously satisfies the subset check against any existing token, consent verification succeeds if the user has ever authorized the client for any single scope. Subsequently, the token issuance logic defaults the empty scope parameter to all scopes registered to the client (req.ValidScopes), allowing a client application with partial consent to silently escalate privileges without user interaction.

TL;DR

A logic flaw in traQ's OAuth 2.0 authorization endpoint allows registered OAuth clients with limited prior user consent to silently escalate privileges to all client-registered scopes by sending a prompt=none authorization request with an empty scope parameter.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-63198 (GHSA-8cfq-jgf7-8m27)
Weakness Class: CWE-863: Incorrect Authorization
CVSS v3.1 Score: 7.3 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Affected Component: router/oauth2/authorization_endpoint.go (AuthorizationEndpointHandler)
Attack Vector: Network (OAuth 2.0 Silent Authorization via prompt=none and empty scope)
Security Impact: Privilege escalation to all scopes registered to the OAuth 2.0 client
EPSS Score: 0.26% (17.25th Percentile)
Patched Version: traQ v3.28.3

Affected Systems

traPtitech traQ (< 3.28.3)
traQ: < 3.28.3 (Fixed in: 3.28.3)

Code Analysis

Commit: 5510fe8

fix OAuth authorization vulnerability

--- a/router/oauth2/authorization_endpoint.go +++ b/router/oauth2/authorization_endpoint.go @@ -203,10 +203,14 @@ func (h *Handler) AuthorizationEndpointHandler(c *echo.Context) error { return c.Redirect(http.StatusFound, redirectURI.String()) } ok := false + requiredScopes := req.Scopes + if len(requiredScopes) == 0 { + requiredScopes = req.ValidScopes + }  for _, v := range tokens { if v.ClientID == req.ClientID { all := true - for s := range req.Scopes { + for s := range requiredScopes {  if !v.Scopes.Contains(s) { all = false break

Mitigation Strategies

Upgrade traQ to version 3.28.3 or later to enforce proper scope expansion prior to silent authorization consent checks.
Audit and revoke existing OAuth 2.0 access and refresh tokens in the database that may have been issued with escalated scopes prior to patching.
Restrict OAuth 2.0 client registration privileges and audit registered clients to ensure they only declare strictly necessary scopes in their valid scope configuration.
Implement reverse proxy or WAF rules to reject requests to /oauth2/authorize containing prompt=none when the scope parameter is missing or empty.

Remediation Steps:

Pull the patched release image or binary for traQ v3.28.3 from https://github.com/traPtitech/traQ/releases/tag/v3.28.3.
Deploy the updated traQ server binary and restart the service.
Inspect the oauth2_tokens database table for tokens associated with third-party OAuth clients that possess broad scopes (write, manage) and revoke suspicious entries.
Review HTTP access logs for /oauth2/authorize requests containing prompt=none and empty scope parameters that returned HTTP 302 redirects with authorization codes.