WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability

Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.8.3...

GHSA-X33G-CR3X-6449 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key x does not correspond to the supplied private key d. When d is present, OKPAlgorithm.fromjwk constructs the Ed25519/Ed448 private key from d without verifying that the public key derived from d matches x...

CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...

CVE-2026-102275

The PyJWT Python library (versions 2.1.0 through 2.15.0 ) is vulnerable in the PyJWT.OKPAlgorithm.from_jwk function within jwt/algorithms.py. The root cause is that the private-JWK import path fails to compare the public key derived from d with x . This allows an attacker to provide non-correspon...

FreeBSD : Rauthy -- Multiple security vulnerabilities (2ec747aa-b97e-11f1-b09d-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ec747aa-b97e-11f1-b09d-8447094a420f advisory. The Rauthy project reports: WebAuthn authentication code is not bound to the user. GHSA-x8jp-v2j6-6vjf...

CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

CVE-2026-87016

Open WebUI, a self-hosted AI platform, is affected by an OAuth authentication bypass in versions 0.6.41 through 0.11.1 . The root cause lies in get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py, where JSON "contains" matching compiled to SQL LIKE substri...

Amazon Linux 2 : 389-ds-base (ALAS-2026-3909)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3909 advisory. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL...

BIT-NODE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-72849

Budibase before 3.40.0 is affected by a cross-site request forgery in the chat-link handoff endpoint. The underlying issue allows an attacker to bind an external chat identity to a victim’s account via a phishing page that auto-submits a POST with a leaked confirmation token, enabling impersonati...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2025-11850 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850

CVE-2025-11850 affects the WSO2 Identity Server: when secondary user stores are configured, the implicit-association resolver can initialize from a secondary store and bypass the primary store during search/uniqueness checks, allowing a subject to be linked to an unintended local account if the s...