CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

EUVD-2026-95037

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107585

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to an uncontrolled eviction issue in the REST API pending sign-in tables. Because the routes for single sign-on (OpenID Connect, SAML) and passkey challenges are accessible without authentication, an unauthenticated remote atta...

CVE-2026-107585 Allocation of Resources Without Limits or Throttling in hMailServer

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-73278

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

EUVD-2026-93940

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...

PT-2026-107187

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OAuth2 and OpenID Connect sign-in paths fail to require a WebAuthn challenge when WebAuthn is the only configured second factor for an account. This allows an attacker who can authenticate...

CVE-2026-73278: Improper Authentication

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...

CVE-2026-105119

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-94276

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276

Apache APISIX versions 3.12.0 through 3.18.0 are vulnerable to an Improper Authentication issue in the openid-connect plugin . When using remote introspection against an authorization server supporting multiple issuers, a token valid for one issuer may be incorrectly accepted on a route restricte...

EUVD-2026-90769

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

PT-2026-103835

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.12.0 through 3.18.0 Description Improper Authentication occurs when using the openid-connect plugin with remote introspection against an authorization server that serves multiple issuers. In this scenario, a token that...