EUVD-2026-28857

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...

Blitz Identity Provider (Authentication server)

...

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP 점검 Citrix NetScaler / NetScaler Gateway 어플라이언스에서 CVE-2026-3055SAML ID 공급자 로 동작할 때 발생하는 메모리 초과 읽기를 탐지하기 위한 Python 헬퍼입니다. 탐지 로직은 watchTowr Labs의 공개 분석 문서와 일치합니다. 사전 요구 사항 Python 3.10+ SAML IdP로 구성된 어플라이언스에만 적용됩니다. 해당 역할이 없는 게이트웨이는 일반적으로 /saml/login에서 404를 반환합니다. 이는 ...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

CVE-2026-3055

🔥 NetScalerBleed2：Citrix NetScaler 中的严重未授权内存过度读取 CVE-2026-3055 未授权越界内存读取（内存泄漏） 仅适用于配置为 SAML 身份提供程序 IdP 的设备 📋 概述 CVE-2026-3055 是 Citrix NetScaler ADC 和 NetScaler Gateway 中的一个严重 越界读取漏洞（CWE-125）。 该漏洞由 SAML 处理过程中输入验证不足 导致。未授权 远程攻击者可触发内存过度读取，泄露设备内存中的敏感数据——包括活动的会话令牌 、凭据或其他机密（在特定条件下）。...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. root@kitploit: python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...

CVE-2023-34362

CVE-2023-34362 CVE-2023-34362 के लिए POC जो MOVEit Transfer को प्रभावित करता है तकनीकी विश्लेषण इस कमजोरी का तकनीकी मूल कारण विश्लेषण ब्लॉग पर पाया जा सकता है: सारांश यह POC एक SQL इंजेक्शन का दुरुपयोग करके sysadmin API एक्सेस टोकन प्राप्त करता है और फिर उस एक्सेस का उपयोग करके एक deserialization...

flask-saml2

flask-saml2 .. note:: In cerca di manutentori. Questo progetto non è più mantenuto. La libreria funziona, o funzionava quando l'ho usata per l'ultima volta, ma non lavoro più al progetto per cui è stata creata. Se sei interessato a prendere la guida e la manutenzione di questo progetto, contattam...

BIT-KEYCLOAK-2026-3009 Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...

BIT-KEYCLOAK-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

authentik

Cos'è authentik? authentik è un Identity Provider IdP open-source per il moderno SSO. Supporta SAML, OAuth2/OIDC, LDAP, RADIUS e altro, progettato per l'auto-hosting da piccoli laboratori a grandi cluster di produzione. La nostra offerta enterprise è disponibile per le organizzazioni per sostitui...

EUVD-2026-64225

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

EUVD-2026-63490

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...

EUVD-2026-62502

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-54730 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-73304

Summary: Budibase prior to 3.39.25 exposed OAuth2 tokens (oauth2.accessToken, oauth2.refreshToken) in user metadata responses. The list endpoint (/api/users/metadata) and the single-user endpoint (/api/users/metadata/:id) return full user profiles without removing these fields, enabling any user ...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

PT-2026-71913

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...