cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

PT-2026-103469

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.30.3 Description OIDC authentication can be initiated even when the OIDC ENABLED variable is set to false. While the '/auth/oidc/enabled' endpoint correctly reports that the feature is disabled, a direct request t...

CLEANSTART-2026-LI01273 flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows

Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows...

CVE-2026-47839

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-86084

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an...

PT-2026-88500

Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...

CVE-2026-47839 - Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin | Cloud Foundry

High CVSS score: 9.2 Critical CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS score: 9.0 Critical CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is Critical unless otherwise noted. UAA – All versions through v77.30.0...

CVE-2026-61641

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass

The version of SimpleHelp running on the remote web server is 5.5.x prior to 5.5.16 or a 6.0 pre-release prior to 6.0 RC2. It is, therefore, affected by an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can...

Malicious code in ing-feat-itsme-oidc-authentication (npm)

Source: amazon-inspector 175d0dba1f70bc84bcd4e29b57e0f7831248582614cd146af7d1ea6d1d057cd5 On npm install, package.json's preinstall hook executes poc.js, which collects os.hostname, os.userInfo.username, process.cwd, and process.platform, base64-encodes the values, and issues an HTTPS GET to...

CVE-2026-54342

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

CVE-2026-55689 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the OIDC authenticator. An attacker can gain access to the API by presenting a JWT that a shared identity provider issued for an unrelated service, because the token's audience aud claim is not validated. This...

SimpleHelp OIDC Authentication Bypass Remote Code Execution

This module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelp's legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An OIDC provid...

CVE-2026-9742: Improper Validation of Specified Type of Input

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product...

CVE-2026-9084 MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid...

CVE-2026-9084: Improper Authentication

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid...

CVE-2026-41200: Improper Neutralization of Input During Web Page Generation

STIG Manager is an API and web client for managing Security Technical Implementation Guides STIG assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scripting XSS vulnerability in the OIDC authentication error handling code in src/init.js and...

CVE-2026-40946

Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience aud claim validation at the library level. This allows tokens issued for unrelate...