boundary

Boundary Was ist Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary Website: https://www.developer.hashicorp.com/boundary/ Foren: HashiCorp Discuss Dokumentation: https://developer.hashicorp.com/boundary/docs Tutorials: HashiCorp's Learn Platform Boundary ist ein...

kratos

Chat · Diskussionen · Newsletter · Dokumentation · Ory Network testen · Jobs Ory Kratos ist ein API-zentriertes Identity- und Benutzerverwaltungssystem für Cloud-native Anwendungen. Es zentralisiert Anmelde-, Registrierungs-, Wiederherstellungs-, Verifizierungs- und Profilverwaltungsabläufe, soda...

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration. id: CVE-2021-24214...

Payara Micro Community 5.2021.6 Directory Traversal

Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability. id: CVE-2021-41381 info: name: Payara Micro Community 5.2021.6 Directory Traversal author: pikpikcu severity: high description: Payara Micro Community 5.2021.6 and below contains a directory traversal...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

FlowAnalyzer

Flow Analyzer Flow Analyzer é projetado para ajudar no entendimento de baixo nível e no teste de Grants/Flows do OAuth 2.0. Embora meus casos de uso sejam do lado da segurança, também pode ser benéfico do ponto de vista de um engenheiro 😊 Você encontrará os notebooks para executar os flows no...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front sequestro de sessão OIDC Front estático que executa o fluxo OIDC authorization code contra um Keycloak e expõe o hook de sequestro de sessionid do PoC. É servido com nginx na porta 5174 para uso da equipe. Subir na VPS root@kitploit: cd vps/pocCVE0264 docker compose up -...

CVE-2026-63687

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

DEBIAN-CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect (a Rails OpenID Connect provider built on Doorkeeper) is vulnerable to scope privilege escalation prior to version 1.10.4 . The Dynamic Client Registration (DCR) endpoint (DynamicClientRegistrationController#application_params) assigns the scope parameter directly from p...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

PT-2026-81890

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4 Description The Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the...

CVE-2026-58314

A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to...

hydra

Chat · Discussioni · Newsletter · Documentazione · Prova Ory Network · Lavora con noi Ory Hydra è un server OAuth 2.0 OpenID Certified, robusto e sicuro, e un provider OpenID Connect, ottimizzato per bassa latenza, elevate prestazioni e basso consumo di risorse. Si collega al tuo identity provide...

oauth-scan

OAUTHScan Descrizione OAUTHScan è un'estensione per Burp Suite scritta in Java con lo scopo di fornire alcuni controlli di sicurezza automatici, che potrebbero essere utili durante i test di penetrazione su applicazioni che implementano gli standard OAUTHv2 e OpenID. Il plugin cerca varie...

dex

dex - Un provider OpenID Connect federato Dex è un servizio di identità che usa OpenID Connect per guidare l'autenticazione per altre app. Dex agisce come un portale verso altri provider di identità tramite "connectors." Questo consente a dex di delegare l'autenticazione a server LDAP, provider...

OAUTHScan

OAUTHScan Beschreibung OAUTHScan ist eine in Java geschriebene Burp-Suite-Erweiterung, die einige automatische Sicherheitsprüfungen bereitstellen soll, die bei Penetrationstests von Anwendungen, die die Standards OAUTHv2 und OpenID implementieren, nützlich sein können. Das Plugin sucht nach...

CVE-2026-54789

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...