Improper handling of case sensitivity in oic-auth

oic-auth 4.452.v2849bd3945fa and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive. On a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter case,...

SUSE CVE-2025-21638

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

UBUNTU-CVE-2025-21638

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

CVE-2024-5138: snapd snapctl auth bypass

Impact A snap with prior permissions to create a mount entry on the host, such as firefox, normally uses the permission from one of the per-snap hook programs. A unprivileged users cannot normally trigger that behaviour by using snap run --shell firefox followed by snapctl mount, since snapd...

MAL-2025-106 Malicious code in uber-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514527f85a2deb8975f95374694c5dc8a3d09d328d3cb7adc36ea16d071367ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uber-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514527f85a2deb8975f95374694c5dc8a3d09d328d3cb7adc36ea16d071367ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-3553 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions prior to 2025.01.01 Description: The issue is related to a permission bypass in the component /interceptors/AuthInterceptor.cava. This component is part of the JeeWMS system, and the bypass could potentially allow unauthorized...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird ESR 128.6 MFSA 2025-05, bsc1234991 Security fixes: CVE-2025-0237 bmo1915257 WebChannel APIs susceptible to confused deputy attack CVE-2025-0238 bmo1915535 Use-after-free when breaking lines in text...

GHSA-8JHW-6PJJ-8723 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Summary An open redirect vulnerability has been identified in the verify email endpoint of Better Auth, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. Affected Versions - All versions...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.5), @vxrn/better-auth (>=1.1.368, <=1.1.416) potentially affected by CVE-2024-56734 +1 more via better-auth (>=1.0.0, <=1.1.5)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.1.368, =1.1.416 Source cves: CVE-2024-56734, CVE-2025-27143 Source advisory: OSV:GHSA-8JHW-6PJJ-8723...

CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on emai...

CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on emai...

CVE-2024-56734

CVE-2024-56734 affects Better Auth (TypeScript) prior to version 1.1.6, where the verify-email endpoint accepts a callbackURL parameter and uses JWT without proper domain validation. This open-redirect flaw can allow an attacker to redirect users to arbitrary, attacker-controlled sites. Root caus...

CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on emai...

Better Auth 输入验证错误漏洞

Better Auth is a framework-agnostic authentication and authorization framework designed for TypeScript. An input validation error vulnerability exists in versions prior to Better Auth v1.1.6, which stems from the presence of an open redirection vulnerability that could allow an attacker to redire...

PT-2025-7795 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to 1.1.21 Description: The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts a callback URL...

PT-2024-37047 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to v1.1.6 Description: An open redirect vulnerability has been identified in the verify email endpoint of Better Auth, potentially allowing attackers to redirect users to malicious websites. This issue affects users...

CVE-2024-56734: URL Redirection to Untrusted Site

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on emai...

UBUNTU-CVE-2024-56564

In the Linux kernel, the following vulnerability has been resolved: ceph: pass cred pointer to cephmdsauthmatch This eliminates a redundant getcurrentcred call, because cephmdscheckaccess has already obtained this pointer. As a side effect, this also fixes a reference leak in cephmdsauthmatch: by...

CVE-2024-54775: Improper Neutralization of Input During Web Page Generation

Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting XSS vulnerability via /admin/auth/menu and /admin/auth/extensions...