CVE-2025-22146

CVE-2025-22146 affects Sentry’s SAML SSO implementation. The vulnerability allows an attacker to impersonate users and take over accounts on the same Sentry instance by leveraging a malicious SAML Identity Provider, with the victim’s email known to exploit it. The SaaS fix was deployed on 2025-01...

FAS - Users from 2-way trusted domain getting "incorrect username or password" on VDA login

Users from primary domain are able to be authenticated without issue. Users from Domain B, which is in a different forest and is trusted via 2-way trust, can authenticate with the storefront without issue. However, when launching a resource the CWA eventually loads a small window indicating the t...

CVE-2023-41873 WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4...

SUSE CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

CVE-2024-10111

CVE-2024-10111 is an authentication bypass in the WordPress plugin OAuth Single Sign On – SSO (OAuth Client). Up to and including version 6.26.3, the token’s returned user is not properly verified, enabling unauthenticated attackers to log in as any existing site user (potentially an Administrato...

GHSA-4V5X-9M47-CQR2 Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5565-3c98-g6jc. This link is maintained to preserve external references. Original Description A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the...

CVE-2024-12369

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

CVE-2024-12369 Elytron-oidc-client: oidc authorization code injection

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

CVE-2024-12369

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

PT-2024-17571

Name of the Vulnerable Software and Affected Versions OIDC-Client versions prior to the fixed version EAP 7.x EAP 8.x Description A vulnerability was found in OIDC-Client, allowing authorization code injection attacks to occur when using the RH SSO OIDC adapter with EAP 7.x or the...

OIDC-Client 数据伪造问题漏洞

OIDC-Client is an IdentityModel open source library that provides OpenID Connect OIDC and OAuth2 protocol support for client-side, browser-based JavaScript client applications. OIDC-Client suffers from a data forgery issue vulnerability that stems from an authorization code injection attack that...

Race Condition

Overview fastapi-sso is a FastAPI plugin to enable SSO to most common providers such as Facebook login, Google login and login via Microsoft Office 365 Account Affected versions of this package are vulnerable to Race Condition. When multiple concurrent login requests are processed simultaneously,...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

[SECURITY] Fedora 41 Update: lemonldap-ng-2.20.1-1.fc41

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

[SECURITY] Fedora 39 Update: lemonldap-ng-2.20.1-1.fc39

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

[SECURITY] Fedora 40 Update: lemonldap-ng-2.20.1-1.fc40

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

CVE-2024-8535

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as...

CVE-2024-8535

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as...

CVE-2024-8535

Affected products: Citrix NetScaler ADC and NetScaler Gateway. Vulnerability: Authenticated users can access unintended user capabilities when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with Kerberos SSO using a KCDAccount, or as an Auth Server (AAA Vserver) wi...