CVE-2026-15611

CVE-2026-15611 affects Logto Identity Platform. An unverified email-based SSO account linking flaw allows an attacker to register the victim’s email at a permissive upstream IdP and link it to the victim’s local account on first login, enabling unauthorized access. Root cause per sources: Logto d...

Logto Identity Platform has authentication and authorization failures in core protocol handling

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

EUVD-2026-47632

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

📄 WordPress CE21 Suite 2.3.1 Unauthenticated SSO API Settings Overwrite

WordPress CE21 Suite plugin version 2.3.1 contains an unauthenticated SSO api settings overwrite vulnerability through missing authorization. A remote attacker can overwrite SSO API configuration without authorization. This proof of concept exploit demonstrates the vulnerable request flow against...

SUSE-SU-2026:3138-1 Security update for 389-ds

This update for 389-ds fixes the following issues - Update to version 2.7.0git212.9b0755edb. - CVE-2026-11610: heap buffer overflow in sasliorecv via padded SASL UNBIND bsc1270695. - CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth bsc1267975. -...

EUVD-2026-45177

SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-63094 SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-63094

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with ...

CVE-2026-54733

The Moodle integration for Microsoft 365/Entra ID (local_o365) is vulnerable prior to 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users based on the upn claim without verifying the JWT signature, enabling an unauthenticated attacker...

CVE-2026-53515

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row a...

CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: tru...

CVE-2026-53513

CVE-2026-53513 affects the @better-auth/sso plugin for Better Auth. When skipDiscovery: true is set, POST /sso/register and POST /sso/update-provider may store attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs without origin validation, leading to server-side r...

CVE-2026-47158 Vaultwarden: CSRF in SSO Authorization Flow

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...

CVE-2026-47158

CVE-2026-47158 – Vaultwarden (Rust) : A CSRF flaw in Vaultwarden’s SSO authorization flow prior to 1.36.0 allowed an unauthenticated attacker to induce IdP authentication and redeem tokens for a fully authenticated session. The root causes include: the OAuth state parameter from /connect/authoriz...

USN-8552-1: Sympa vulnerability

It was discovered that Sympa did not properly validate input on the generic SSO login. A remote attacker could possibly use this issue to perform a path traversal attack and gain unintended access...

PT-2026-60243

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.2.10 through 1.6.10 Description The @better-auth/sso plugin contains a flaw where the registerSSOProvider function in the 'POST /sso/register' endpoint only verifies organization membership without requiring an owner or...