Unverified Password Change

Overview Affected versions of this package are vulnerable to Unverified Password Change in the OAuth2 authentication module when the password is silently rewritten to the username upon OAuth2 re-login. An attacker can gain unauthorized access to user accounts by authenticating with both the...

CVE-2024-48953

An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication plugins in Logpoint, resulting in unauthorized access...