2790 matches found
CVE-2026-54885
Boruta exposes a Server-Side Request Forgery (SSRF) in its OAuth/OpenID flow. Three code paths fetch URIs supplied by the requester (request_uri and jwks_uri) with minimal validation: only scheme presence, no HTTPS enforcement, no host/IP allowlist, and no checks against loopback/private ranges o...
EUVD-2026-51143
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-18353
PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...
CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...
CVE-2026-18353
PIA’s POST /v1/upload/sbom validates a Bearer JWT by checking the unverified iss against an issuer allowlist using urlparse, then performs OIDC discovery with requests. A backslash in the authority (e.g., https://[email protected]/) is parsed into different hostnames, enabling an attac...
CVE-2026-48058
Summary of CVE-2026-48058 (nebula-mesh) nebula-mesh (Slack Nebula mesh control plane) versions prior to 0.3.2 expose a cookie security flaw: internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on cookies but omit the Secure attribute. A plaintext HTTP request to the ori...
DEBIAN-CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
CVE-2026-54603
Summary (CVE-2026-54603) OAuth2 (Ruby) versions 0.4.0 through 2.0.21 leak credentials via protocol-relative redirects during the OAuth2::Client#request flow. When a 301/302/303/307 redirect’s Location header is protocol-relative (//host/...), the client’s base URL is overridden and the original A...
PT-2026-65537
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...
BIT-OPENBAO-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...
PT-2026-65051
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...
Keycloak 26.2 < 26.2.15 / 26.4 < 26.4.11 / 26.5 < 26.5.7 Multiple Vulnerabilities
Keycloak installed on the remote host is 26.2.x prior to 26.2.15, 26.4.x prior to 26.4.11, 26.5.x prior to 26.5.7 are affected by multiple vulnerabilities: - A privilege escalation flaw exists due to improper isolation in the SingleUseObjectProvider. An unauthenticated, remote attacker can forge...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...
PT-2026-64407
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...
GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh
When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...
CVE-2026-15612
Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...