Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881

CVE-2026-14881 affects MongoDB Compass: during imports of connections, an attacker can override connection options that are not normally changeable via the connection form. Specifically, a custom browser open command for the OIDC authentication flow can be injected, which is typically configured ...

EUVD-2026-47781

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-14881

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: spire1.14: spire1.14-1.14.7-0.2.hum1 aarch64, x8664 spire1.14-agent-1.14.7-0.2.hum1 aarch64, x8664 spire1.14-oidc-discovery-provider-1.14.7-0.2.hum1 aarch64, x8664 spire1.14-server-1.14.7-0.2.hum...

PT-2026-63483

Name of the Vulnerable Software and Affected Versions Compass affected versions not specified Description When importing connections, it is possible to override connection options that are typically restricted to the connection form. Specifically, a custom browser open command can be provided for...

Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Locale middleware when processing unauthenticated HTTP requests containing a specially crafted Accept-Language header. An attacker can exhaust server CPU resources by sending large...

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

CVE-2026-16336

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...

CVE-2026-16336 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...

PT-2026-63290

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The software contains two Server-Side Request Forgery SSRF issues. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

OESA-2026-3012 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...

OESA-2026-3009 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...