kanidm

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeover Proof of Concept for CVE-2026-49757 — a critical vulnerability in AshAuthentication where OAuth2/OIDC callbacks resolved to local user accounts by email address instead of the strategy, sub identity pair, allowing unauthenticated...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

kanidm v1.11.2

Kanidm - Simple and Secure Identity Management About Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm. The goal of this project is to be a complete identity provider,...

GHSA-777C-2FXX-QR28 AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than by the OpenID Connect iss/sub claim combination. A provider login presenting a victim's email including an unverified, reused, or emailverified: false account resolved to and signed i...

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than by the OpenID Connect iss/sub claim combination. A provider login presenting a victim's email including an unverified, reused, or emailverified: false account resolved to and signed i...

CVE-2026-16336

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...

CVE-2026-16336: URL Redirection to Untrusted Site

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...

com.nimbusds:oauth2-oidc-sdk (2.0) potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.15.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.0 Source cves: CVE-2025-53864 Source advisory: OSV:GHSA-XWMG-2G98-W7V9...

com.nimbusds:oauth2-oidc-sdk (>=2.1, <=2.8), com.nimbusds:oidc-userinfo-ldap (1.0) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.16)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.1, =2.8 - com.nimbusds:oidc-userinfo-ldap 1.0 -...

com.nimbusds:oauth2-oidc-sdk (2.9), com.nimbusds:oidc-userinfo-ldap (1.1) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.18.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.9 - com.nimbusds:oidc-userinfo-ldap 1.1 - com.nimbusds:oidc-userinfo-sp...

com.nimbusds:oauth2-oidc-sdk (2.10) potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.18.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.10 Source cves: CVE-2025-53864 Source advisory: OSV:GHSA-XWMG-2G98-W7V9...

com.nimbusds:common (>=1.73, <=1.74), com.nimbusds:oauth2-oidc-sdk (2.11) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.19)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:common =1.73, =1.74 - com.nimbusds:oauth2-oidc-sdk 2.11 - com.nimbusds:oidc-userinfo-ldap...

com.goinstant:goinstant-auth (>=1.0.3, <=1.0.5), com.nimbusds:oauth2-oidc-sdk (>=2.12, <=2.13) potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.20)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.goinstant:goinstant-auth =1.0.3, =2.12, =2.13 Source cves: CVE-2025-53864 Source advisory:...

com.nimbusds:oauth2-oidc-sdk (3.0.1), com.nimbusds:oidc-claims-source-ldap (1.2.3) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.24)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 3.0.1 - com.nimbusds:oidc-claims-source-ldap 1.2.3 -...

com.nimbusds:oauth2-oidc-sdk (>=4.6, <=4.7), com.nimbusds:oidc-session-store (1.2) potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.2.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =4.6, =4.7 - com.nimbusds:oidc-session-store 1.2 Source cves: CVE-2025-538...

com.nimbusds:oauth2-oidc-sdk (4.8), com.nimbusds:oidc-session-store (>=1.2.2, <=1.3.1) potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.4)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 4.8 - com.nimbusds:oidc-session-store =1.2.2, =1.3.1 Source cves:...

com.github.kikuomax:spray-jwt-shapeless2_2.10 (>=0.0.1, <=0.0.3), com.github.kikuomax:spray-jwt-shapeless2_2.11 (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.5)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.kikuomax:spray-jwt-shapeless22.10 =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 -...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

com.nimbusds:oauth2-oidc-sdk (>=2.1, <=2.8), com.nimbusds:oidc-userinfo-ldap (1.0) +1 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.16)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.1, =2.8 - com.nimbusds:oidc-userinfo-ldap 1.0 -...