EUVD-2026-87701

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100606

Flowise versions through 3.1.4 (Enterprise/platform mode with SSO enabled) are vulnerable to an authentication bypass in the SSO login path. The root cause lies in verifyAndLogin (SSOBase.ts:80-94 ), which incorrectly copies the database user record—including the server-stored tempToken—into the ...

CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100607: Improper Authentication

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including...

PT-2026-99355

Name of the Vulnerable Software and Affected Versions Budibase versions 3.41.0 through 3.44.9 Description An authentication bypass exists in the OIDC/SSO login path of @budibase/server. Within the sso.authenticate function, the server fails to validate an invite code or perform an email verified...

CVE-2026-100684: Improper Authentication

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

CVE-2026-100606: Improper Authentication

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

PT-2026-99277

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description An authentication bypass exists in the SSO login path when Enterprise/platform mode with SSO is enabled. The issue occurs when an SSO callback is received with an email matching a user with an INVITE...

PT-2026-99278

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description The software resolves Single Sign-On SSO and local-password users based only on the email address, failing to store provider or subject identifier bindings. This allows an attacker to authenticate as...

CVE-2026-84458

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-53625

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

UBUNTU-CVE-2026-53625

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

EUVD-2026-87286

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-53625 GLPI: Privilege Escalation via authtype API manipulation

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-53625 GLPI: Privilege Escalation via authtype API manipulation

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-53625

The asset management software GLPI versions 0.70 through 11.0.7 is vulnerable to a high-severity privilege escalation vulnerability (CVE-2026-53625). A low-privilege Technician can manipulate the authtype value via the REST API to change another user's authentication method. Specifically, changin...

CVE-2026-53625 GLPI: Privilege Escalation via authtype API manipulation

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

EUVD-2026-87261

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...