CVE-2026-114456

Multiple Snowflake client drivers using the authenticator=externalbrowser SSO flow are vulnerable to an Origin Validation Error (CWE-346) . The local loopback callback listener fails to verify a CSRF state value and reflects arbitrary request Origin headers into CORS responses. This allows an att...

PT-2026-136929

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...