1129 matches found
CVE-2026-87109: Insertion of Sensitive Information Into Sent Data
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organizatio...
CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...
Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201
This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...
Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...
SUSE SLES12 Security Update : wpa_supplicant (SUSE-SU-2026:4494-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4494-1 advisory. - CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. - Fixed incomplete RADIUS Message-Authenticator attribute...
Security update for wpa_supplicant
This update for wpasupplicant fixes the following issues: CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd Patch Instructions: To install this SUSE update use the SUSE recommended installation...
SUSE-SU-2026:4494-1 Security update for wpa_supplicant
This update for wpasupplicant fixes the following issues: - CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. - Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd...
CVE-2026-105301
Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only...
EUVD-2026-92255
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
CVE-2026-105301
...
CVE-2026-105301
A flaw exists in the X.509 client-certificate authenticator of Keycloak , an identity and access management solution. When the server is configured to perform certificate revocation checks via CRL Distribution Points or OCSP , an attacker can provide a specially crafted certificate pointing to a ...
CVE-2026-105301
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
PT-2026-104725
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...
CVE-2026-105301: Server-Side Request Forgery (SSRF)
Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only...
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...
CVE-2026-103884
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...
CVE-2026-103884
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...