{"action":"Upgrade buildbot to 2.0.1-2 or later.","affected":[{"fixed":"2.0.1-2","introduced":"0"}],"component":"buildbot","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.0.1-2"],"id":"tcs_01M5NDQZ7CZJGR522QMCCG3WF9","modified_at":"2026-09-21T07:00:27.731570527Z","published_at":"2019-05-23T15:30:12.623Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-12300","https://security-tracker.debian.org/tracker/CVE-2019-12300"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-12300#Debian:13/buildbot","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-12300"}],"summary":"Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details"}