CVE-2026-74240

The CVE concerns Red Hat Quay’s JWT validation for federated robot accounts and SSO, where flawed audience verification and insufficient enforcement of azp and sub allow a token from the same identity provider to bypass security boundaries, potentially leading to unauthorized access where audienc...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

PT-2026-72126

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description Red Hat Quay contains flaws in the validation of JSON Web Tokens JWT used for single sign-on SSO authentication and federated robot accounts. The issues involve improper audience...

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "emailverified" claim and do not actually verify the email. This allows a user to...

CVE-2026-72772

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

EUVD-2026-56098

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

PT-2026-70235

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email verified" claim and do not actually verify the email. This allows a user to...

CVE-2026-19278

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

EUVD-2026-55617

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

CVE-2026-19278

CVE-2026-19278 concerns StackRox/RHACS Central. The flaw lies in the Auth Machine-to-Machine (M2M) token exchange where, during M2M role mapping, unanchored regular expressions are used to match claim values. This allows an attacker with a valid OpenID Connect (OIDC) token whose claim value is a ...

EUVD-2026-53859

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

PT-2026-68178

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the...

CVE-2026-18572

Keycloak is affected by a vulnerability in its time-based access control. A flaw allows a user to include a fake time value in an authorization request, which overrides the actual server time and bypasses time-based restrictions, potentially granting access to protected resources outside allowed ...

SUSE CVE-2026-55669

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...

CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...