shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY --SamlValidity...

Blitz Identity Provider (Authentication server)

...

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP check Python helper to probe Citrix NetScaler / NetScaler Gateway appliances for CVE-2026-3055 memory overread when acting as a SAML Identity Provider. Detection logic matches the public write-up from watchTowr Labs. Prerequisites Python 3.10+ Only applies to...

flask-saml2

flask-saml2 .. note:: Looking for maintainers. This project is unmaintained. The library works, or did when I last used it, but I no longer work on the project this was built for. If you are interested in taking over leadership and maintenance of this project, please get in touch. .. image::...

CVE-2023-34362

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on the blog: Summary This POC abuses an SQL injection to obtain a sysadmin API access token and then uses that access to abuse a deserialization cal...

CVE-2026-115360

A flaw was found in OpenBao. An open redirect vulnerability in the user interface for the OpenID Connect OIDC identity provider allows a remote attacker to redirect unauthenticated users to arbitrary, attacker-controlled websites. By convincing a victim to follow a crafted OIDC link, an attacker...

CVE-2026-3055

🔥 NetScalerBleed2: Critical Unauth Memory Overread in Citrix NetScaler CVE-2026-3055 Unauthenticated Out-of-Bounds Memory Read Memory Leak Only on appliances configured as SAML Identity Provider IdP 📋 Overview CVE-2026-3055 is a critical out-of-bounds read vulnerability CWE-125 in Citrix NetScale...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

CVE-2026-115360

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

EUVD-2026-108285

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360

OpenBao versions before 2.6.3 are vulnerable to an open redirect vulnerability located in the UI's OIDC identity provider . This flaw impacts unauthenticated users , as attackers can craft malicious OIDC links to redirect them to attacker-controlled destinations, potentially facilitating phishing...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

PT-2026-121540

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description The UI's OIDC identity provider allows unauthenticated users to be redirected to external, attacker-controlled destinations via specially crafted OIDC links. This issue can be leveraged to facilitate...

Linux Distros Unpatched Vulnerability : CVE-2026-102631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls...

CVE-2026-104108 FileRise OIDC login can bind an attacker identity to an existing local account

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

CVE-2026-102899

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

EUVD-2026-101287

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...