38 matches found
CVE-2026-107503
Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...
CVE-2026-107503
Eclipse Ditto Ditto Explorer versions 3.6.0 through 3.9.7 are vulnerable to an unvalidated environments URL flaw. An attacker can use a crafted link to inject an attacker-controlled OIDC authority with autoSso enabled. When the UI initiates a login, it exchanges the genuine authorization code and...
CVE-2026-107503
Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197
Eclipse Ditto's Node.js JavaScript client hard-codes rejectUnauthorized: false in its WebSocket transport, disabling TLS certificate chain and hostname validation for every wss:// connection. All released versions of @eclipse-ditto/ditto-javascript-client-node (2.0.0–3.9.0) and its predecessor @e...
EUVD-2026-74162
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197: Improper Certificate Validation
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
PT-2026-88447
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node 1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false...
CVE-2026-82958
In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...
CVE-2026-84175
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...
CVE-2026-82958
Eclipse Ditto versions [1.3.0, 3.9.6] are affected by a JSON injection flaw in the ImplicitThingCreationMessageMapper of the connectivity service. When building a CreateThing command, placeholder values resolved from inbound message headers (e.g., MQTT 5 user properties, AMQP 1.0 application prop...
CVE-2026-82958
In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...
CVE-2026-82958
In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...
EUVD-2026-69896
In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...
CVE-2026-82958
In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:deviceid resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...
CVE-2026-84175
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...
CVE-2026-84175
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...
EUVD-2026-69894
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...