CVE-2026-3531

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

CVE-2026-3532

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

CVE-2024-12369 Elytron-oidc-client: oidc authorization code injection

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

PT-2024-17571

Name of the Vulnerable Software and Affected Versions OIDC-Client versions prior to the fixed version EAP 7.x EAP 8.x Description A vulnerability was found in OIDC-Client, allowing authorization code injection attacks to occur when using the RH SSO OIDC adapter with EAP 7.x or the...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

oidcc security vulnerabilities

oidcc is an open source OpenId Connect client library in Erlang & Elixir by The Erlang Ecosystem Foundation. A security vulnerability exists in oidcc 3.0.0 and later, which stems from the presence of a Denial of Service DoS vulnerability...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2023-52428...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2023-52428...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2023-52428...

com.microsoft.aad:adal4j (0.0.1), com.nimbusds:oauth2-oidc-sdk (>=2.14.2, <=3.0) +7 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.22.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.microsoft.aad:adal4j 0.0.1 - com.nimbusds:oauth2-oidc-sdk =2.14.2, =1.2, =1.2, =1.24.0, =1.1.1,...

com.nimbusds:oauth2-oidc-sdk (>=3.4, <=3.4.1), com.nimbusds:oidc-claims-source-ldap (>=1.2.7, <=1.2.9) +10 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.26.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.4, =1.2.7, =1.2.7, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.7.0, =4.3.1,...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12973...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2017-12973...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12974...