ossf vulnerabilities

Products

• github.com/ossf/allstar 1

Latest ossf CVEs

Newest publication first

1. CVE-2025-61926 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret

   Published 2025-10-09

   Medium·CVSS 4.6

   Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.