56 matches found
keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
CVE-2026-112208
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
CVE-2026-112208 Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
EUVD-2026-117568
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
CVE-2026-112208
The Keycloak authentication server is vulnerable to an account takeover via a flaw in the Organization identity-first login flow. The root cause is a failure to properly clear a success flag when a user is removed from a session after switching to a registration or password reset path. An attacke...
CVE-2026-112208
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...
PT-2026-137542
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Organization identity-first login flow of the Keycloak authentication server. The issue occurs when a user belonging to multiple organizations initiates a login and...
CVE-2026-50641
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
CVE-2026-50641
Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...
CVE-2026-50641
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
EUVD-2026-50306
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
PT-2026-65789
Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...
CVE-2026-55579
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...
CVE-2026-47325
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...
CVE-2026-47325
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...
CVE-2026-47325 Weak password policy in ProjectsAndPrograms school-management-system
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...
CVE-2026-47325 Weak password policy in ProjectsAndPrograms school-management-system
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...
PT-2026-45943
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...