CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-18353

PIA’s POST /v1/upload/sbom validates a Bearer JWT by checking the unverified iss against an issuer allowlist using urlparse, then performs OIDC discovery with requests. A backslash in the authority (e.g., https://[email protected]/) is parsed into different hostnames, enabling an attac...

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-48058

Summary of CVE-2026-48058 (nebula-mesh) nebula-mesh (Slack Nebula mesh control plane) versions prior to 0.3.2 expose a cookie security flaw: internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on cookies but omit the Secure attribute. A plaintext HTTP request to the ori...

DEBIAN-CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

GHSA-3735-5339-XFWX Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...

CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

CVE-2026-54603

Summary (CVE-2026-54603) OAuth2 (Ruby) versions 0.4.0 through 2.0.21 leak credentials via protocol-relative redirects during the OAuth2::Client#request flow. When a 301/302/303/307 redirect’s Location header is protocol-relative (//host/...), the client’s base URL is overridden and the original A...

GHSA-W6P7-2FXX-4F44 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...

PT-2026-65537

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

GO-2026-6083 Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev...

GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

BIT-OPENBAO-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...

PT-2026-65051

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...

Keycloak 26.2 < 26.2.15 / 26.4 < 26.4.11 / 26.5 < 26.5.7 Multiple Vulnerabilities

Keycloak installed on the remote host is 26.2.x prior to 26.2.15, 26.4.x prior to 26.4.11, 26.5.x prior to 26.5.7 are affected by multiple vulnerabilities: - A privilege escalation flaw exists due to improper isolation in the SingleUseObjectProvider. An unauthenticated, remote attacker can forge...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...

GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...