OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass

The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...

GHSA-HHF8-F5W9-G6VH OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass

The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...

TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-002...

PT-2024-23225 · Typo3 · Openid Connect Authentication Extension For Typo3

Name of the Vulnerable Software and Affected Versions: OpenID Connect Authentication extension for TYPO3 affected versions not specified Description: The issue concerns a security bypass in the authentication service of the OpenID Connect Authentication extension for TYPO3. The authentication...

CVE-2024-31107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...

CVE-2024-31107 WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...

CVE-2024-31107

Technical details for CVE-2024-31107 are not provided in the supplied documents. Monitor for updates; current materials reference XSS broadly but do not specify affected versions, vectors, exploit status, or fixes.

CVE-2024-31107 WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...

PT-2024-23776 · Openid · Openid

Name of the Vulnerable Software and Affected Versions: OpenID versions through 3.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For versions through...

WordPress Plugin OpenID 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin OpenID versions = 3.6.1...

WordPress OpenID Plugin <= 3.6.1 is vulnerable to Cross Site Scripting (XSS)

Software OpenID Type Plugin Vulnerable versions = 3.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31107 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 70ed2305fa1e Credits Dimas Maulana Required privilege...

Coder 安全漏洞

Coder is an application from Coder that allows you to set up a development environment in a public or private cloud infrastructure. A security vulnerability exists in Coder and CoderV2 that stems from a security hole in OIDC authentication that allows an attacker to bypass authentication and crea...

CVE-2024-28239 URL Redirection to Untrusted Site in OAuth2/OpenID in directus

Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth...

CVE-2024-28239 URL Redirection to Untrusted Site in OAuth2/OpenID in directus

Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth...

BIT-GITLAB-2023-2182

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users...

BIT-GITEA-2021-45325

Server Side Request Forgery SSRF vulneraility exists in Gitea before 1.7.0 using the OpenID URL...

Debian dla-3751 : libapache2-mod-auth-openidc - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3751 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3751-1 [email protected] https://www.debian.org/lts/security/...

Internet Bug Bounty: CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPE

CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID2.0 is in use as AUTHTYPE. When OpenID2.0 was used as the Authentication Type, an attacker could forge authentication to any existing account in the target Airflow installation by deceiving the backend to trust arbitrary Open...

PT-2024-22135

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.6.1 Coder versions prior to 2.7.3 Coder versions prior to 2.8.4 Description A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODER OIDC EMAIL DOMAIN verification and create an accou...