CVE-2025-64099

OpenAM prior to version 16.0.0 is vulnerable when the claims_parameter_supported parameter is enabled. The oidc-claims-extension.groovy script allows injecting arbitrary values into claims in id_token and user_info via a crafted claims parameter JSON during an authorize request, enabling potentia...

OESA-2025-2430 google-oauth-java-client security update

Written by Google, the Google OAuth Client Library for Java is a powerful and easy-to-use Java library for the OAuth 1.0a and OAuth 2.0 authorization standards. The Google OAuth Client Library for Java is designed to work with any OAuth service on the web, not just with Google APIs. It is built o...

EUVD-2018-13380

Malware in sbrugna...

CVE-2025-9485

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the...

CVE-2025-9485

CVE-2025-9485 is an authentication-bypass flaw in the WordPress plugin “OAuth Single Sign On – SSO (OAuth Client)” up to v6.26.12. The root cause is improper verification of cryptographic signatures due to unsafe JWT handling in get_resource_owner_from_id_token, enabling unauthenticated attackers...

CVE-2025-9485 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the...

PT-2025-40621

Name of the Vulnerable Software and Affected Versions OAuth Single Sign On – SSO OAuth Client plugin for WordPress versions up to and including 6.26.12 Description The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is susceptible to improper verification of cryptographic signatures...

EUVD-2022-0744

Malicious code in bioql PyPI...

CVE-2018-20840

An unhandled exception vulnerability exists during Google Sign-In with Google API C++ Client before 2019-04-10. It potentially causes an outage of third-party services that were not designed to recover from exceptions. On the client, ID token handling can cause an unhandled exception because of...

CVE-2025-47884

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...

GHSA-Q7C3-X7HM-QQ72 Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...

CVE-2025-47884

CVE-2025-47884 affects Jenkins OpenID Connect Provider Plugin versions 96.vee8ed882ec4d and earlier. The issue arises from build ID Token generation using potentially overridden environment variable values, which, when combined with other plugins that allow environment variable overrides, enables...

CVE-2025-47884

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...

CVE-2025-27403

The CVE describes a vulnerability in Ratify where Azure authentication providers could exchange an Entra ID token for an ACR refresh token without verifying that the target registry is an Azure Container Registry. This could allow EID tokens with ACR access to be exposed if a workload references ...

CVE-2023-26071

creationtimestamp| type| source ---|---|--- 2025-02-19 19:13:54+00:00| seen| Telegram/ptlGRyvTMqTgdL-Rr59nCy6BNwa7QMAn7eiYXasJ8njI5alV...

Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud Audience claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client. This vulnerability may allow attackers to subvert the authentication flow...

Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the iss Issuer claim of an ID Token during its authentication flow, a value that identifies the Originating Party IdP. This vulnerability may allow attackers to subvert the authentication flow, potentially...

CVE-2024-47807

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the iss Issuer claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins...

CVE-2024-47806

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the aud Audience claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins...

CVE-2024-47807

CVE-2024-47807 affects Jenkins OpenId Connect Authentication Plugin up to version 4.354.v321ce67a_1de8. The root cause is that the plugin does not validate the Issuer (‘iss’) claim of the ID Token, which can allow an attacker to subvert the authentication flow and potentially gain administrator a...