CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

PT-2026-107710

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-55982

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982

The Gitea application is vulnerable to an issue where the OIDC userinfo Endpoint returns identity claims without enforcing API token scopes . This vulnerability allows for the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea v1.27.0 , which includes fixe...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

EUVD-2026-58138

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982: Exposure of Sensitive Information to an Unauthorized Actor

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

SUSE CVE-2026-55982

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

PT-2026-65363

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /login/oauth/userinfo endpoint. An attacker can access identity claims such as email and groups by supplying a personal access token with insufficient scopes as a bearer...

GHSA-MG4F-X9V4-6H2P Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

PT-2026-63279

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token...

Prezta: Provable Remote Execution of Zero-Trust Authorization Using SNARKs

Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access...

UBUNTU-CVE-2026-33246

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NAT...

GHSA-55H8-8G96-X4HJ NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers. NATS messages can have headers. Problem...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...