n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

EUVD-2026-42610

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

EUVD-2026-47632

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

EUVD-2026-47498

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim LOV. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

EUVD-2026-47161

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim LOV. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

CVE-2026-62447

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim LOV. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

CVE-2026-60875

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim LOV. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

EUVD-2026-44689

Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim...

CVE-2026-64094 batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then while operating on this interface getting decoupled from the mesh...

PT-2026-61411

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference occurs in the batman-adv module when a hard interface is retrieved as the primary interface of a mesh interface but becomes decoupled from it before the rtnl...

Fedora 44 : roundcubemail (2026-517daa8d64)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-517daa8d64 advisory. Release 1.7.2 - Add HEAD request handler to the static.php - Fix so the oauthpasswordclaim claim is retrieved via token or userinfo request 9631 - F...

CVE-2026-61452

The Grav API plugin getgrav/grav-plugin-api before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti JWT ID claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime...

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

PT-2026-60180

Name of the Vulnerable Software and Affected Versions Cloudreve versions 4.12.0 through 4.16.0 Description OAuth access tokens are issued without the client id claim. Consequently, the JWT JSON Web Token verifier fails to load token scopes into the request context. This causes the RequiredScopes...

CVE-2026-45069

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...

CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...

CVE-2026-45069

CVE-2026-45069 concerns Symfony’s OidcTokenHandler, where verifyClaims() registered aud/iss/exp checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). Consequently, a validly signed JWT missing these claims could pass verification. The issue is fixed in Symfony relea...