7764 matches found
CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...
EUVD-2026-53857
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...
CVE-2026-68481 Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider
In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...
CVE-2026-57817
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...
CVE-2026-57817
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...
CVE-2026-57817 Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...
CVE-2025-11850
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...
EUVD-2025-210627
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...
CVE-2025-11850
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...
CVE-2025-11850
CVE-2025-11850 affects the WSO2 Identity Server: when secondary user stores are configured, the implicit-association resolver can initialize from a secondary store and bypass the primary store during search/uniqueness checks, allowing a subject to be linked to an unintended local account if the s...
CVE-2026-18967
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...
CVE-2026-18967
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...
EUVD-2026-53716
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...
CVE-2026-18967
The CVE affects Keycloak’s SAML broker component when configured as an IdP-Initiated flow. The vulnerability arises because OneTimeUse in SAML assertions is not enforced, allowing an attacker who captures a valid, unused assertion to replay it and potentially hijack a user’s session, granting una...
CVE-2026-18967 Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...
KLA91189 Multiple vulnerabilities in Google Chrome
Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in WebGL can be exploited remotely to execute arbitrary...
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...
GHSA-42CJ-M3VJ-89WV Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...