CVE-2026-1202 CRMEB LoginController.php appleLogin improper authentication

A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out...

CVE-2026-1202 CRMEB LoginController.php appleLogin improper authentication

A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out...

CVE-2026-1202

A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out...

CVE-2026-1202

CVE-2026-1202 affects CRMEB up to version 5.6.3. The vulnerable element is the appleLogin function in crmeb/app/api/controller/v1/LoginController.php, where manipulating the openId argument results in improper authentication. This allows remote exploitation, and public-proof-of-concept exploits e...

PT-2026-3524

Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 5.6.4 Description A security flaw exists in CRMEB that allows improper authentication. This is due to manipulation of the openId argument within the appleLogin function located in the file...

CRMEB authorization issue vulnerabilities

CRMEB is an open-source Java e-commerce system developed by CRMEB. Versions of CRMEB 5.6.3 and earlier contained a vulnerability related to authorization issues. This vulnerability stemmed from incorrect handling of the parameter openId in the file crmeb/app/api/controller/v1/LoginController.php,...

MiracleLinux 8 : mod_auth_openidc:2.3 Security and Bug Fix update (AXSA:2020-809:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-809:01 advisory. modauthopenidc: Open redirect in logout url when using URLs with leading slashes CVE-2019-14857 modauthopenidc: Open redirect issue exists in URLs wi...

MiracleLinux 7 : mod_auth_openidc-1.8.8-5.el7 (AXSA:2019-4244:01)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2019-4244:01 advisory. modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an AuthType oauth20 configuration CVE-2017-6413 modauthopenidc: Shows user-supplied...

MiracleLinux 3 : drupal-6.30-1.AXS3 (AXSA:2014-234:01)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-234:01 advisory. Drupal is a free software package that allows an individual or a community of users to easily publish, manage and organize a wide variety of content ...

CVE-2026-21409

Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC OpenID...

Astra Linux – Vulnerability in Ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as its JWT algorithm. By doing this, the JWT signature is not checked. The vulnerability lies most likely in the RadosGW OIDC provider. As of the time of...

MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2025-9893:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9893:01 advisory. modauthopenidc: modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492 Tenable has extracted the preceding descripti...

MiracleLinux 9 : mod_auth_openidc-2.4.10-1.el9_6.1 (AXSA:2025-10456:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2025-10456:01 advisory. modauthopenidc: modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492 Tenable has extracted the preceding...

MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2025-9917:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9917:01 advisory. modauthopenidc: DoS via Empty POST in modauthopenidc with OIDCPreservePost Enabled CVE-2025-3891 Tenable has extracted the preceding description block direct...

CVE-2026-22772 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.5, Fulcio's metaRegex function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF on...

CVE-2026-22772

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.5, Fulcio's metaRegex function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF on...

CVE-2023-50770

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining...

CVE-2008-6836

Cross-site request forgery CSRF vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors...

CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

CVE-2026-21409

Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC OpenID...