https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-46251.htmlhttps://patchthecve.com/cve/CVE-2021-46251.htmlWed, 17 Jun 2026 04:14:41 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.https://patchthecve.com/cve/CVE-2021-46250.htmlhttps://patchthecve.com/cve/CVE-2021-46250.htmlWed, 17 Jun 2026 04:14:41 +0000CRITICAL 10.0: An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.https://patchthecve.com/cve/CVE-2021-46249.htmlhttps://patchthecve.com/cve/CVE-2021-46249.htmlWed, 17 Jun 2026 04:14:41 +0000MEDIUM 6.5: An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.https://patchthecve.com/cve/CVE-2021-29437.htmlhttps://patchthecve.com/cve/CVE-2021-29437.htmlWed, 17 Jun 2026 03:47:38 +0000HIGH 8.0: ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user