1879 matches found
DEBIAN-CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
GHSA-3735-5339-XFWX Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
CVE-2026-54603
Summary (CVE-2026-54603) OAuth2 (Ruby) versions 0.4.0 through 2.0.21 leak credentials via protocol-relative redirects during the OAuth2::Client#request flow. When a 301/302/303/307 redirect’s Location header is protocol-relative (//host/...), the client’s base URL is overridden and the original A...
GHSA-W6P7-2FXX-4F44 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions
OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...
PT-2026-65537
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...
GO-2026-6083 Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim in gitea.dev...
BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...
BIT-OPENBAO-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...
PT-2026-65051
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...
Keycloak 26.2 < 26.2.15 / 26.4 < 26.4.11 / 26.5 < 26.5.7 Multiple Vulnerabilities
Keycloak installed on the remote host is 26.2.x prior to 26.2.15, 26.4.x prior to 26.4.11, 26.5.x prior to 26.5.7 are affected by multiple vulnerabilities: - A privilege escalation flaw exists due to improper isolation in the SingleUseObjectProvider. An unauthenticated, remote attacker can forge...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...
GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...
CVE-2026-48032
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0...
PT-2026-64407
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...
GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh
When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...
