Hello,

As a fix has been released, it has became publicly known that the Nameless-OAuth2 Module prior to version 1.3.0 has a critical vulnerability which allows any registered users to gain access to any applications. 

We are here to assure that Spooky Services and users were NOT affected by this vulnerability.

This exploit was discovered by us, Spooky Services, during our security tests. 
We have promptly reported this issue to the developer and a fix was released in under 12 hours.
Before the fix has been released, Spooky Services have made a micro-patch to secure the system. 

While we were using version 1.2.0, a supposedly vulnerable version, we are confident that it was not exploitable on our infrastructure even before the micro-patch. 

This exploit requires the user interface for normal users to edit OAuth2 Applications.
While this page template exists in the Default template, which would allow the exploit to work, Spooky Services did not port over the vulnerable module default template to our own theme when we updated the module. 
Any attempt to visit the vulnerable user endpoints will only receive a "Smarty Template Error" and no app info would be provided. 

However, as a security precaution, all client secrets have also been regenerated. 

All new security measurements and fixes from 1.3.0 has now been ported into the Spooky Services Hub.

As NamelessMC modules updates has to be done by website owners manually, we do not know how many websites are still vulnerable. Therefore, a public disclosure of this vulnerability will not happen.

We are committed to user security and transparency to bring you a safe environment.
Thank you for choosing Spooky Services