Taskview Community before version 1.56.0 suffers from a missing authentication flaw that permits anyone to register new OAuth clients through the Dynamic Client Registration endpoint, which is enabled by default. An attacker can POST to the registration endpoint, receive a client identifier and secret, then create a malicious authorization URL that redirects to a server under the attacker’s control. By capturing the returned authorization code and exchanging it for an access token, the attacker obtains full API access to the victim’s account and can read, modify, or delete data. This allows complete compromise of any authenticated user without needing to authenticate to the application itself.

The vulnerability affects the Gimanh Taskview Community application in all releases prior to 1.56.0. This includes any deployment of Taskview Community where the default OAuth Dynamic Client Registration endpoint remains active.

The flaw carries a CVSS score of 8.5, indicating a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only an unauthenticated HTTP POST to the registration endpoint, which is reachable from any network location that can reach the application. Because the endpoint requires no authentication and returns client credentials to anyone, exploitation is straightforward and has the potential to affect all users of the compromised installation.