2964 matches found
EUVD-2026-51839
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328
Summary: CVE-2026-67328 affects @better-auth/sso versions before 1.6.21, which contain multiple authentication bypass vulnerabilities in the SSO provider handling. This can allow attackers to sign in as arbitrary users, enabling unauthorized session access and account takeover. Exploitation vecto...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
CVE-2026-67328 @better-auth/sso before 1.6.21 Account Takeover via SSO
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...
EUVD-2026-51653
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
PT-2026-67308
Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.6.21 Description Multiple authentication bypass issues exist in the handling of SSO providers, allowing attackers to sign in as arbitrary users. This can be achieved through domain verification parsing...
Improper Authentication
Overview feehi/cms is a Feehi CMS project template. Affected versions of this package are vulnerable to Improper Authentication in the Session management module, authentication logic, and logout handler components. An attacker can gain unauthorized access or escalate privileges by exploiting...
CVE-2026-51953
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
Improper Verification of Cryptographic Signature
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services...
CVE-2026-51953: Insufficient Session Expiration
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
CVE-2026-51953
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
CVE-2026-51953
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
CVE-2026-51953
The FeehiCMS project template, specifically version v.2.1.1 , is vulnerable to improper authentication and privilege escalation. The root cause lies in flaws within the Session management module , authentication logic , and logout handler components . An attacker can exploit these weaknesses in s...
PT-2026-66863
Name of the Vulnerable Software and Affected Versions FeehiCMS version 2.1.1 Description An issue exists in the Session management module, authentication logic, and logout handler components that allows an attacker to escalate privileges. Recommendations At the moment, there is no information abo...
CVE-2026-51953
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...
SUSE CVE-2026-34454
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be...
SUSE CVE-2026-55671
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...