RHLW-2026-2CEEE64F37112E19 Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-CF52DC28CCB66C72 Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-C23E4577FAE1D333 Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

CVE-2026-73302: Improper Authentication

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-44428

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

CVE-2026-44428: Server-Side Request Forgery (SSRF)

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

GHSA-95C3-6VVW-4MRQ MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

SECURITY registry001 Vulnerability Report While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. Overview - Verified Version: c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OID...

CVE-2022-39222

A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The...

CVE-2022-39222: Exposure of Sensitive Information to an Unauthorized Actor

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can...

CVE-2022-39222

Dex is an OpenID Connect identity service. Affected versions prior to 2.35.0 with public clients can have the OAuth authorization code exposed during the OIDC flow when a victim visits a malicious site. An attacker can then exchange the stolen authorization code for a token to gain access to appl...

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

Impact Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the...