140 matches found
CVE-2026-25916-Roundcube-Webmail-DOM-based-XSS-Exploit-via-SVG-href-Attribute
CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploit Information Exploit Title: Roundcube Webmail DOM XSS via SVG href CVE-2026-25916 Author: Mohammed Idrees Banyamer Contact: GitHub @mbanyamer | Instagram @banyamersecurity Country: Jordan Date: February 9, 2026 CVE: CVE-2026-25916 Type:...
cve-2023-42820
cve-2023-42820 JumpServer Affected Versions v2.24 - v3.6.4 Impact With knowledge of the email associated with the JumpServer admin user account default: admin/[email protected], it is possible to reset the admin password through this vulnerability, and by combining it with JumpServer's...
CVE-2026-106488
A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...
EUVD-2026-94007
Backstage: Improper authentication in the OIDC provider...
CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests
MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...
CVE-2026-107276: Concurrent Execution using Shared Resource with Improper Synchronization
MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...
CVE-2026-106488 Backstage: Improper authentication in the OIDC provider
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...
CVE-2026-106488
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...
CVE-2026-106488 Backstage: Improper authentication in the OIDC provider
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...
CVE-2026-106488 Backstage: Improper authentication in the OIDC provider
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...
CVE-2026-106488: Improper Authentication
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-93355
The LiteLLM platform is vulnerable to a weak JWT authentication flaw caused by an email-based fallback lookup that fails to verify the email_verified claim. An attacker with a valid JWT from a configured identity provider can authenticate as any existing user by using an unverified email address ...
CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-93355 LiteLLM Weak JWT Authentication via Email-Based User Lookup
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-55210
Joplin Server prior to 3.7.2 contains a vulnerability in UserModel.ssoLogin() where the method returns an existing account matched by an IdP-asserted email without checking the is_external flag . In deployments using mixed local and SAML authentication , an attacker whose IdP session can assert a...
CVE-2026-14559 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...
CVE-2026-86117
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...