CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

PT-2026-64018

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15615: Insufficient Verification of Data Authenticity

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

Oracle WebLogic Server (July 2026 CPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core...

CVE-2026-15614: Authentication Bypass by Capture-replay

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

PT-2026-64168

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login versions prior to 5.4.5 Description An authentication bypass exists due to the mo saml validate signature function performing a loose boolean check on the integer returned by PHP's openssl verify. An error retur...

SUSE-SU-2026:22854-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

CVE-2026-60206

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise...

SUSE SLES15 Security Update : shibboleth-sp (SUSE-SU-2026:3123-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3123-1 advisory. This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the...

CVE-2026-60206: Missing Authentication for Critical Function

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise...

SUSE-SU-2026:3123-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

K000162341: Multiple Spring framework vulnerabilities

Security Advisory Description CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19;...

Linux Distros Unpatched Vulnerability : CVE-2026-49284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforc...

SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2026:3098-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3098-1 advisory. This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cach...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

SUSE-SU-2026:3098-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

CVE-2026-49284: Insufficient Verification of Data Authenticity

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking...

CVE-2026-63094: URL Redirection to Untrusted Site

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-15013: Improper Verification of Cryptographic Signature

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...

Incorrect Authorization

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization via the POST /sso/register endpoint, which allows any organization member to attach a new SSO provider without verifying admin or owner privileges. An attacker can...