CVE-2026-15617 Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

CVE-2026-15617

The Logto identity and access management platform is vulnerable to principal collision and unauthorized account access due to a lack of string normalization. The software performs strict, unnormalized comparisons on email domains , issuer identifiers , and identity IDs during SSO flows. Because t...

CVE-2026-15617

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

GHSA-7RQJ-J65F-68WH Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

CVE-2026-7120

The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...

PT-2026-64021

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...

PT-2026-71919

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32 Description The defaultNormalizer used in the email and magic-link sign-in flow validates an email address before applying Unicod...

PT-2026-64188

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description A path traversal issue exists in the static file controller. Unauthenticated remote attackers can read arbitrary files, including system files and environment configuration files containing...

PT-2026-63799

Name of the Vulnerable Software and Affected Versions libcupsfilters affected versions not specified Description A flaw in the cfIEEE1284NormalizeMakeModel function allows a network-adjacent attacker to cause a denial of service. The issue occurs when the function processes a printer-advertised...

Incorrect Behavior Order: Validate Before Canonicalize

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize when enforcing blocklists for extension installation due to insufficient normalization of package names. An attacker can bypass...

GO-2026-6024 File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser

File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

CVE-2026-16560

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation. Mitigation Deni...