EUVD-2026-117058

Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider...

CVE-2026-113373

Sonatype Nexus Repository 3 Pro is vulnerable to an authentication bypass because it fails to verify the local account status during sign-in via SAML or OAuth2/OpenID Connect identity providers. An administrator may disable or lock a local account, but the user can still obtain a new session with...