EUVD-2026-86223

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203: Missing Authorization

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

PT-2026-97857

Name of the Vulnerable Software and Affected Versions Logto versions 1.31.0 through 1.41.0 Description Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller with a same-user access token containing only the openid scope to retrieve stored social or enterpri...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

CVE-2026-82843

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

EUVD-2026-85030

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

The vulnerability of the Authlib OAuth 2.0 library server against OAuth and OpenID Connect servers allows a hacker to redirect a user to any given URL address.

The vulnerability of the Authlib OAuth 2.0 library server for OAuth and OpenID Connect servers involves redirecting the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

CVE-2026-78428: Session Fixation

For users authenticated through SAML or OpenID Connect OIDC, this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

Astra Linux – Vulnerability in Ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as its JWT algorithm. By doing this, the JWT signature is not checked. The vulnerability lies most likely in the RadosGW OIDC provider. As of the time of...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

GHSA-PF83-W3F9-8M37 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...

CVE-2026-55221

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

EUVD-2026-70239

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

CVE-2026-55221 Boruta: OAuth credentials exposed in Boruta business logs

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...