11201 matches found
Authentication Bypass by Primary Weakness
Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the SAML Identity Provider authentication process whe...
Where Multi-Factor Authentication Stops and Credential Abuse Starts
Organizations typically roll out multi-factor authentication MFA and assume stolen passwords are no longer enough to access systems. In Windows environments, that assumption is often wrong. Attackers still compromise networks every day using valid credentials. The issue is not MFA itself, but...
openssl:provider: Stack-buffer-overflow in ossl_fnv1a_hash
Project: https://github.com/openssl/openssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4528137794027520 Project: openssl Fuzzing Engine: libFuzzer Fuzz Target: provider Job Type: libfuzzerasani386openssl Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...
GHSA-2JPR-83RG-V67J django-allauth has an open redirect vulnerability
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
django-allauth has an open redirect vulnerability
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
EUVD-2026-9652
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
CVE-2026-27982
A flaw was found in django-allauth. This open redirect vulnerability exists when Security Assertion Markup Language SAML Identity Provider IdP initiated Single Sign-On SSO is enabled, which is disabled by default. A remote attacker could exploit this by crafting a malicious URL, potentially...
PYSEC-2026-56
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
DEBIAN-CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
UBUNTU-CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
django-allauth vulnerable to open redirect
Overview django-allauth is a package for implementing user authentication in Django applications. django-allauth contains the following vulnerability. Open redirect CWE-601 - CVE-2026-27982 Ayato Shitomi of Fore-Z co.ltd and Funabiki Keisuke of GMO Cybersecurity by Ierae, Inc. reported this...
CVE-2026-3009: Incorrect Authorization
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the...
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled it is disabled by default, which may allow an attacker to redirect users to an arbitrary external website via a crafted URL...
PT-2026-23494
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A security issue exists in org.keycloak.broker.saml. Specifically, a disabled Security Assertion Markup Language SAML client configured as an Identity Provider IdP-initiated broker landing...
PT-2026-23133
Name of the Vulnerable Software and Affected Versions django-allauth versions prior to 65.14.1 Description An open redirect issue exists when SAML IdP initiated SSO is enabled, which is disabled by default. This may allow an attacker to redirect users to an arbitrary external website through a...
PT-2026-23493
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A security flaw in the 'IdentityBrokerService.performLogin' endpoint allows authentication to proceed using an Identity Provider IdP even after it has been disabled by an administrator. An...
GHSA-PR34-2V5X-6QJQ ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint
Summary A vulnerability was discovered in Zitadel's login V2 interface that allowed a possible account takeover. Impact Zitadel exposes an HTTP endpoint named /saml-post. This endpoint is used for handling requests to SAML IdPs and accepts two HTTP GET parameters: url and id. When these parameter...