CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 contains an authentication bypass that allows unauthenticated account takeover . The plugin fails to verify whether the email address in a Firebase authentication token has been confirmed before matching it to a WordPress account and issui...

CVE-2026-55089 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

EUVD-2026-62737

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication on Query/Mutation and a...

EUVD-2026-58817

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240

The CVE concerns Red Hat Quay’s JWT validation for federated robot accounts and SSO, where flawed audience verification and insufficient enforcement of azp and sub allow a token from the same identity provider to bypass security boundaries, potentially leading to unauthorized access where audienc...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

PT-2026-72126

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description Red Hat Quay contains flaws in the validation of JSON Web Tokens JWT used for single sign-on SSO authentication and federated robot accounts. The issues involve improper audience...

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-72772

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

EUVD-2026-56098

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

PT-2026-70235

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email verified" claim and do not actually verify the email. This allows a user to...

CVE-2026-19278

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

EUVD-2026-55617

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

CVE-2026-19278

CVE-2026-19278 concerns StackRox/RHACS Central. The flaw lies in the Auth Machine-to-Machine (M2M) token exchange where, during M2M role mapping, unanchored regular expressions are used to match claim values. This allows an attacker with a valid OpenID Connect (OIDC) token whose claim value is a ...