EUVD-2026-118752

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's o...

EUVD-2026-118689

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent ...

CVE-2026-17291

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to an open redirect vulnerability during OAuth 2.0 sign-in. The root cause is a failure to sufficiently validate the redirect address, which may allow a remote authenticated attacker to intercept auth...

EUVD-2026-118683

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authenticatio...

CVE-2026-123283

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

EUVD-2026-118048

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

CVE-2026-123283

In JetBrains Datalore versions prior to 2026.4 , an account takeover vulnerability exists. The root cause is Improper Session Invalidation (CWE-1464) occurring during SSO sign-in to a pre-registered account. This flaw allows an attacker to potentially seize control of a user account. While the ba...

CVE-2026-123283: JetBrains Datalore: In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account...

CVE-2026-113373

Sonatype Nexus Repository 3 Pro is vulnerable to an authentication bypass because it fails to verify the local account status during sign-in via SAML or OAuth2/OpenID Connect identity providers. An administrator may disable or lock a local account, but the user can still obtain a new session with...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

CVE-2026-117656: pow-auth assent: Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

Pow Assent authorization issue vulnerability

Versions 0.1.25 through 0.3.2 of Pow Assent contain a security vulnerability. This vulnerability stems from the Sign in with Apple policy’s incorrect trust of the user-controlled user parameter, which is then merged onto the validated ID token claims. As a result, unauthenticated remote attackers...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

EUVD-2026-114568

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

EEF-CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims

Summary Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the...

CVE-2026-117656

The pow-auth Assent authentication library is vulnerable to an authentication bypass (CWE-290, CWE-349) in its Sign in with Apple strategy, affecting versions 0.1.25 before 0.3.2 . The root cause is the unsafe merging of untrusted data from the user form parameter (provided by the browser during ...

CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

PT-2026-134252

Name of the Vulnerable Software and Affected Versions assent versions 0.1.25 through 0.3.1 Description An unauthenticated remote attacker can impersonate other users by manipulating the user parameter during the Sign in with Apple authorization callback. The issue occurs because the...