russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

MuseScore — CWE-532 / MOAD-0004 Disclosure Brief (musescore-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One credential-logging defect in MuseScore's cloud authentication service. Patched. AbstractCloudService::onUserAuthorized() logs OAuth2 access and refresh tokens to the application debug log in plaintext.

The Defect

musescore-0002 (PATCHED — HIGH): src/framework/cloud/internal/abstractcloudservice.cpp:215

// In onUserAuthorized() — fires on every successful OAuth2 login:
LOGD() << "========== access " << m_accessToken << " ========= refresh " << m_refreshToken;

Both m_accessToken (OAuth2 bearer token) and m_refreshToken are written to the debug log in cleartext. Debug logs may persist on disk, appear in crash reports, or be shared when users report issues.

Impact

MuseScore is the world's most popular open-source music notation software, with millions of users. The cloud service handles MuseScore.com account authentication. Leaked access tokens allow account impersonation; leaked refresh tokens allow persistent unauthorized access. Users who share debug logs for troubleshooting inadvertently expose their credentials.

The Fix

Redact token values in log output:

// Before
LOGD() << "========== access " << m_accessToken << " ========= refresh " << m_refreshToken;

// After
LOGD() << "========== access [REDACTED] ========= refresh [REDACTED]";

Patch

Fix available: defects/musescore-0002/patch/musescore-0002.patch

Touches abstractcloudservice.cpp. One-line change. Replaces token values with [REDACTED] in log output.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (musescore/MuseScore).
Assess severity — credential exposure via debug logs.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the MuseScore team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History