Missing Authorization

Overview github.com/zitadel/zitadel/internal/api/oidc is a package for identity infrastructure Affected versions of this package are vulnerable to Missing Authorization due to missing enforcement of organization scopes in the zitadel process. An attacker can gain unauthorized access to resources ...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the RefreshSignInAsync function method, which does not verify the identity of the calling TUser, allowing an attacker to escalate privileges to that of another user. Remediation Upgrade...

Malicious code in ccf-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e1d06cfd35d1e890891bb8c0478cd64f1c31901595ecd8a80a676d989d93b86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identity-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d7563819f33fd96fcc6cfdbb40434f9ba5fd41b63c990af654c1fd5ba100611 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...